Category: Virtualization

vCenter certificate validation error during 6.7 to 7.0 upgrade

While I was trying to upgrade the vCenter to 7 Update 3, ended up with an error saying

“The machine SSL certificate in the VMware Endpoint Certificate Store (VECS) does not correspond with the service registration in the VMware Directory Service (vmdir)”

The remediation steps are pretty straightforward as per their KB 2121701

In order to ease and speed up the process, you can simply follow the below steps.

  • Take a snapshot or a full backup of the source vCenter
  • Download the automated script from the VMware community
  • Copy the file to # /usr/lib/vmidentity/tools/scripts (you may use a utility like WinSCP)
  • Run the below commands

python ls_ssltrust_fixer_p3.py -f scan

python ls_ssltrust_fixer_p3.py -f fix

ESXi Host Unresponsive and Error 404 not found

If you come across below errors and behaviors, there is a great possibility of having a corrupted Proxy endpoint configuration file. So, will look at how we can remediate all those issues with a simple workaround. 

  • Accessing ESXi host using the web interface (https://esxihost/ui) shows Error 404 not found.
  • ESXi host shows Not Responding
  • Cannot manage the hosted VMs

Below is the list of steps that are required in fixing the issue (commands are in Bold Italic)

SSH into the host and take a backup of the endpoint configuration file

cp /etc/vmware/rhttpproxy/endpoints.conf /etc/vmware/rhttpproxy/Backup-endpoints.conf

Open the config file with VI editor and remove/add the below lines in the configuration file

  • Remove – /ui local 8308 redirect allow
  • Add – /ha-nfc local 12001 allow allow

Then save and exit the Editor window. Help on VI

Typically, the configuration file will look like below

/      local 8309 redirect allow
/cgi-bin local 8303 redirect allow
/client/clients.xml local 8309 allow allow
/fdm local 9089 reject allow
/folder local 8309 redirect allow
/guestFile local 8309 redirect allow
/ha-nfc local 12001 allow allow
/host local 8309 redirect allow
/mob namedpipe /var/run/vmware/proxy-mob redirect allow
/mobfdm local 9090 redirect allow
/nfc local 12000 allow allow
/screen local 8309 redirect allow
/sdk local 8307 redirect allow
/sdkTunnel namedpipetunnel /var/run/vmware/proxy-sdk-tunnel allow reject
/ticket tickettunnel /var/run/vmware/ticket/%1 redirect allow
/tmp local 8309 redirect allow
/vpxa local 8089 reject allow
/vsan local 9096 redirect allow
/vsanperf localtunnel 9095 allow reject
/vvold local 8090 allow allow
/wsman local 8889 redirect allow

Finally, restart both Hostd and Web proxy services

  • /etc/init.d/hostd restart
  • /etc/init.d/rhttpproxy restart