Search the VMware Knowledge Base (KB)
View by Article ID

Replacing certificates using VMware vSphere 6.0 Certificate Manager fails at 0% with the error: Operation failed, performing automatic rollback (2111571)

  • 14 Ratings

Symptoms



  • The certificate-manager.log file is located at these locations.
  • Replacing the Machine SSL Certificate or Solution User Certificates with Custom CA Certificates fails at 0%.
  • The vSphere 6.0 Certificate Manager displays an error similar to:

    Status : 0% Completed [Publishing Root cert...]
    Status : 0% Completed [Operation failed, performing automatic rollback]
    Error while replacing Machine SSL Cert, please see C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log
    for more information.
    Performing rollback of Machine SSL Cert...

  • The certificate-manager.log file indicates that the dir-cli command to publish the trusted cert failed and you see entries similar to:

    <YYYY-MM-DD>T<TIME> INFO certificate-manager Running command : ['C:\\Program Files\\VMware\\vCenter Server\\vmafdd\\dir-cli.exe', 'trustedcert', 'publish', '--cert', 'C:\\certs\\machineSSL\\cachain.cer', '--password', '*****']
    <YYYY-MM-DD>T<TIME> INFO certificate-manager Command output :- 
    <YYYY-MM-DD>T<TIME> ERROR certificate-manager 
    <YYYY-MM-DD>T<TIME> ERROR certificate-manager Error while replacing Machine SSL Cert, please see C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log for more information.
    <YYYY-MM-DD>T<TIME> ERROR certificate-manager {
    "resolution": null, 
    "detail": [
    {
    "args": [
    ""
    ], 
    "id": "install.ciscommon.command.errinvoke", 
    "localized": "An error occurred while invoking external command : ''", 
    "translatable": "An error occurred while invoking external command : '%(0)s'"
    }, 
    "Error while publishing cert using dir-cli."
    ], 
    "componentKey": null, 
    "problemId": null
    }

    Note:

    • The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

    • The certificate-manager.log file is located in these locations:

      • Windows vCenter Server 6.0: C:\ProgramData\VMware\vCenterServer\logs\vmca\certificate-manager.log
      • vCenter Server Appiance 6.0: /var/log/vmware/vmcad/certificate-manager.log

Cause

All Intermediate(s) and the Root CA certificates must be published into the trusted store in VMware Endpoint Certificate Store for the script to complete.

Note: This issue can also be caused by using non-Base64 certificates. For more information on creating certificates, see Creating a Microsoft Certificate Authority Template for SSL certificate creation in vSphere 6.0 (2112009).

Resolution

This issue is resolved in VMware vCenter Server 6.0.0b, available at VMware Downloads. For more information, see the VMware vCenter Server 6.0.0b Release Notes.

To work around this issue, manually publish the full chain to the VMware Endpoint Certificate Store:

For Windows vCenter Server 6.0:
  1. Click Start > Run, type cmd and press Enter.
  2. Add the certificate to the VMware Endpoint Certificate Store with this command:

    "C:\Program Files\VMware\vCenter Server\vmafdd\dir-cli.exe" trustedcert publish --chain --cert 
    path_to_chain.cer

    Note: The path_to_chain.cer is the complete path to the full chain of Intermediate CA(s) and Root CA. 

  3. Enter the password for administrator@vsphere.local when prompted.
  4. Run the certificate replacement option again.
  5. When the Certificate Manager asks for the signing certificate provide just the Root CA certificate and not the full chain of CA certificates.

    For example:

    Please provide the signing certificate of the Machine SSL certificate
    File : "C:\certs\machineSSL\root_ca.cer"
For vCenter Server Appliance 6.0:
  1. If the certificates are not currently on the vCenter Server Appliance copy them to a directory on the file system such as /root using a utility such as WinSCP or Filezilla.

    Note: VMware does not endorse or recommend any particular third-party utility, nor is the list above meant to be exhaustive.

  2. Connect to the vCenter Server Appliance through the console and press ALT+F1.
  3. Log in using the root user and password.
  4. Type shell.set --enabled true and press Enter.
  5. Type shell and press Enter.
  6. Add the certificate to the VMware Endpoint Certificate Store with this command:

    /usr/lib/vmware-vmafd/bin/dir-cli trustedcert publish --chain --cert path_to_chain.cer

  7. Enter the password for administrator@vsphere.local when prompted.
  8. Run the certificate replacement option again.
  9. When the Certificate Manager asks for the signing certificate provide just the Root CA certificate and not the full chain of CA certificates.
For example:

Please provide the signing certificate of the Machine SSL certificate
File : "/root/root_ca.cer"

See Also

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.

Feedback

  • 14 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)




Please enter the Captcha code before clicking Submit.
  • 14 Ratings
Actions
KB: