Search the VMware Knowledge Base (KB)
View by Article ID

vSphere Client and vSphere PowerCLI may fail to connect to vCenter Server 5.0, 5.1 and 5.5 due to a Handshake failure (2049143)

  • 137 Ratings

Details

When installed on a Windows XP or Windows Server 2003 host machine, the vSphere Client and vSphere PowerCLI may fail to connect to vCenter Server 5.0, 5.1 and 5.5 due to a Handshake failure. vSphere 5.0, 5.1 and 5.5 uses the Open SSL library, which, for security, is configured by default to accept only connections that use strong cipher suites. On Windows XP or Windows Server 2003, the vSphere Client and vSphere PowerCLI do not use strong cipher suites to connect with vCenter Server. This results in the error No matching cipher suite on the server side, and a Handshake failure on the vSphere Client or vSphere PowerCLI side.

Solution

To work around this issue, perform one of these options:

      1. Connect to the vCenter Server using RDP.
      2. Navigate to the directory:

        C:\ProgramData\VMware\VMware VirtualCenter\

      3. Backup the vpxd.cfg file. Do not skip this step.
      4. Open the vpxd.cfg file in a text editor
      5. Add the <cipherList>ALL</cipherList> parameter between the <ssl>...</ssl> section of the configuration file, for example:

        <config>
        ...
        <vmacore>
        ...
        <ssl>
        ...
        <cipherList>ALL</cipherList>
        ...
        </ssl>
        ...
        </vmacore>
        ...
        </config>

      6. Save and close the vpxd.cfg file.
      7. Restart the vCenter Server service for the setting to take affect. For more information, see Stopping, starting, or restarting vCenter services (1003895).


                For the vCenter Server Appliance

      1. Connect to the vCenter Server Appliance via SSH. For more information, see Enable or Disable SSH Administrator Login on the VMware vCenter Server Appliance in the vCenter Server and Host Management Guide.
      2. Navigate to the directory:

        /etc/vmware-vpx/

      3. Backup the vpxd.cfg file. Do not skip this step.
      4. Open vpxd.cfg file in a plan text editor
      5. Add the <cipherList>ALL</cipherList> parameter between the <ssl>...</ssl> section of the configuration file, For example:

        <config>
        ...
        <vmacore>
        ...
        <ssl>
        ...
        <cipherList>ALL</cipherList>
        ...
        </ssl>
        ...
        </vmacore>
        ...
        </config>

      6. Save and close the vpxd.cfg file.
      7. Restart the vCenter Server service for the change to take effect. For more information, see Stopping, starting, or restarting vCenter Server Appliance services (2054085).

    • On the ESXi 5.1 and 5.5 host, modify the rhttpproxy service to reduce the implied security by allowing the host to communicate using weak cipher suites: 

       For ESXi 5.1 and 5.5
      1. Connect to the host via SSH. For more information, see Using ESXi Shell in ESXi 5.0 and 5.1 (2004746).
      2. Navigate to the directory:

        /etc/vmware/rhttpproxy/

      3. Backup the config.xml file. Do not skip this step.
      4. Open config.xml file using vi editor. For more information, see Editing files on an ESX host using vi or nano (1020302).
      5. Add the <cipherList>ALL</cipherList> parameter between the <ssl>...</ssl> section of the configuration file. Use the model below as an example:

        <config>
        ...
        <vmacore>
        ...
        <ssl>
        <doVersionCheck> false </doVersionCheck>
        <useCompression>true</useCompression>
        <libraryPath>/lib/</libraryPath>
        <handshakeTimeoutMs>120000</handshakeTimeoutMs>
        <cipherList>ALL</cipherList>
        </ssl>
        ...
        </vmacore>
        ...
        </config>

      6. Save and close the config.xml file
      7. Reset the rhttpproxy service for the change to take effect by running the command:

        /etc/init.d/rhttpproxy restart

Additional Information

For translated versions of this article, see:

Update History

03/20/2014 - Added Product VMware ESXi 5.1.x, VMware ESXi 5.1.x, VMware vCenter Server 5.1.x, and VMware vCenter Server Appliance 5.1.x

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 137 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 137 Ratings
Actions
KB: