Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

vSphere Update Manager displays the error "Server certificate assertion not verified and thumbprint not matched" in the vSphere Client (HTML5) (55092)

Last Updated: 2/13/2020Categories: TroubleshootingTotal Views: 7730Language:
Chinese (Simplified)JapaneseEnglish

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

When accessing vSphere Update Manager in the vSphere Client (HTML5), the following error is shown in a red banner at the top of the screen

com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate assertion not verified and thumbprint not matched

The vsphere_client_virgo.log located in /var/log/vmware/vsphere-ui/logs/ has the following message:

Certificate for <hostname.domain> doesn't match common name of the certificate subject: vpxd-extension

vSphere Update Manager is still accessible from the vSphere Web Client (Flex)

Cause

This issue is due to the vpxd-extension Solution User certificate not containing a Subject Alternative Name. Currently, using the Certificate Management UI in the vSphere Client (HTML5) to renew the vpxd-extension certificate will cause this problem.

Resolution

This issue is resolved in vCenter Server 6.7.0c, available at VMware Downloads .

For more information on patching a vCenter Server Appliance node, see Patching the vCenter Server Appliance and Platform Services Controller Appliance.

Workaround

To workaround the issue, update the vpxd-extension solution user certificate with one that contains a Subject Alternative Name matching the FQDN of the vCenter Server.

Open an SSH session to the vCenter Server Appliance and login with root credentials

Using a text editor, create a new vpxd-extension.cfg file which includes the SAN field. This will be used during the certificate creation process. Use the example below as a reference. The values marked in RED are variables that should be changed.

[ req ]
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req

[ v3_req ]
basicConstraints = CA:false
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = DNS:FQDN.domain.com

[ req_distinguished_name ]
countryName = US
stateOrProvinceName = California
localityName = Palo Alto
0.organizationName = VMware
organizationalUnitName = GSS
commonName = vpxd-extension

Run this command to create a new certificate request, where vpxd-extension.cfg is the file created in step 2.

openssl req -new -nodes -out vpxd-extension.csr -newkey rsa:2048 -keyout vpxd-extension.key -config vpxd-extension.cfg

​​Run this command to create the new vpxd-extension certificate.

openssl x509 -req -days 3650 -in vpxd-extension.csr -out vpxd-extension.crt -CA /var/lib/vmware/vmca/root.cer -CAkey /var/lib/vmware/vmca/privatekey.pem -extensions v3_req -CAcreateserial -extfile vpxd-extension.cfg

Move the newly created vpxd-extension.crt and vpxd-extension.key files to a workstation that can access the vSphere Client (HTML5).

For help connecting to the vCenter appliance with WinSCP - Error when uploading files to vCenter Server Appliance using WinSCP (2107727)

Log into the vSphere Client (HTML5) and navigate to the Certificate Management UI.

From the Home menu, select Administration.

Under Certificates, click Certificate Management.

Populate the server name and enter the SSO administrator credentials.

In the box for vpxd-extension, click Actions and select Replace.

Select the new vpxd-extension.crt file for the Certificate Chain.

Select the new vpxd-extension.key file for the Private Key.

Click Replace.

Restart update manager service. For more information see VMware Doc.

Alternatively, use the vSphere Web Client (Flex) to manage and administer vSphere Update Manager.

Related Information

Simply renewing the vpxd-extension certificate will not fix this issue. The new certificate will be generated with the same properties as the original one.

It is also possible to replace the solution user certificates with the certificate-manager CLI utility. It is necessary to ensure the choice to generate all the certificates with a configuarion file is used for this to be effective though. Additionally, this will replace all of the solution user certificates, instead of only the one used for vpxd-extension.

Locations of certificate-manager by guest OS
vCenter Appliance: /usr/lib/vmware-vmca/bin/certificate-manager
Windows: C:\Program Files\VMware\vCenter Server\vmcad\certificate-manager.bat

For more information:
See here if you see entries similar to: com.vmware.vim.vmomi.core.exception.CertificateValidationException: Server certificate chain not verified

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)JapaneseEnglish

Attachments

Additional Resources

KB
•
部署/升级到 VCSA 6.7 时出现“错误: 无法创建初始 dc 注册值 (ERROR: failed to create initial dc reg value)”错误 (57133)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

Take Our Survey

Support Assistant