Errors observed:
/var/log/vmware/vpxd-svcs/vpxd-svcs.log: 2020-06-03T09:31:04.523Z [pool-8-thread-1 INFO com.vmware.identity.token.impl.X509TrustChainKeySelector opId=905f6864-c067-4db6-828c-1d59c4b43bf8] Failed to find trusted path to signing certificate <CN=ssoserverSign> sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
vCenter certificates are expired or expire soon.
VxRail versions which were initially built prior to 4.7, may have certificates issued with a lifespan of two years from the date of installation. At the time of writing of this article, a VxRail build on 4.7.410 has all certificates with a 10-year lifespan.
Minor version upgrades do not touch the certificates!
For a VxRail which was initially built on 4.5.210 and later versions, the certificates have a two-year validity period. Check the VMware article for VMware Security Token Service (STS) Checking Expiration of STS Certificate on vCenter Servers (79248) to confirm the detailed description.
Use the view certificate in the browser of the log-in page of the VCSA to confirm the certificate has expired. Or list the certificates in the CLI of the Platform Services Controller (PSC) (VCSA). See commands from VMware article Signing certificate is not valid" error in VCSA 6.5.x,6.7.x or vCenter Server 7.0.x, 8.0.x. (76719)
for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done
Fix PSC:
Reset all Certificates (This fails but that is expected.)
/usr/lib/vmware-vmca/bin/certificate-manager
"Do you wish to generate all certificates using configuration file : Option[Y/N] ?"
"Continue operation : Option[Y/N] ?"
"Continue operation : Option[Y/N] ?"
Get site nameCompleted [Reset Machine SSL Cert...]
g3node-site
Lookup all services
Get service xxxxxx-site:xxxxxxx-d202-4d8f-9282-xxxxxx317b8f
Update service xxxxxx-site:xxxxxxxx-d202-4d8f-9282-xxxxxx317b8f; spec: /tmp/svcspec_a1hipoqq
Status : 0% Completed [Reset operation failed]
please see /var/log/vmware/vmcad/certificate-manager.log for more information.
root@xxxxc [ ~ ]#
Fix the STS issue
Download and run the script from VMware article "Signing certificate is not valid" error in VCSA 6.5.x,6.7.x or vCenter Server 7.0.x, 8.0.x. (76719)
service-control --all --stop
service-control --all --start
/usr/lib/vmware-vmca/bin/certificate-manager
"Do you wish to generate all certificates using configuration file : Option[Y/N] ?"
"certool.cfg file exists, Do you wish to reconfigure : Option[Y/N] ?"
"You are going to regenerate Solution User Certificates using VMCA, Continue operation : Option[Y/N] ?"
service-control --all --status
Fix Certificates on VCSA
Stop and start all services. This MUST be done AFTER all PSC services are running!
service-control --all --stop
service-control --all --start
/usr/lib/vmware-vmca/bin/certificate-manager
"Do you wish to generate all certificates using configuration file : Option[Y/N] ?"
"Continue operation : Option[Y/N] ?"
"Continue operation : Option[Y/N] ?"
"Reset status : 100% Completed [Reset completed successfully]"
service-control --all --status
Log in to the vCenter over SSH as the root user
Restart Services
"service-control --stop --all"
"service-control --start --all"
Reset all Certificates
"/usr/lib/vmware-vmca/bin/certificate-manager"
Follow the article Dell VxRail: How to manually import vCenter SSL certificate on VxRail Manager to import the updated vCenter and CA certificates into the VxRail Manager trust store.