Unable to verify certificate for vCenter on Horizon View Connection Server
Recently during an outage of my host during to hardware issue in my home lab where my vCenter 6.0 sit on it, resulted some strange behaviour on my View Connection Server 6.1. I encounter the below error message:
When I go to my Horizon View Dashboard, it looks fine.
When I try to remove the vCenter entry under the Server options and adding it back I end up with another error when trying to add the View Composer.
However this is not related to the strange behaviour above. But rather this is due to my login did not contain a domain\username but instead of use just username.
Back to the strange behaviour. It seems my connection to my vCenter via Connection Server has a sudden slowness and the certificate seems to be corrupted. I tried to find a solution to replace the self-signed (in my case) certificate on my View Connection Server however in vain. I tried removing the vCenter and re-adding it back, that does not help.
So I chanced upon some steps by our internal team and use it to resolve my problem and it works.
In summary, this is what was done. First we backup the ADAM database and then we invalid the entry of the vCenter in View Connection Server. Then we try to add the existing vCenter again. So now we have two entry of the vCenter where oneis an invalid entry. Taking from the valid entry certificate thumbprint, we overwrite the invalid ones and remove the latter vCenter entry. Next revert back the entry to previous valid entry.
Here are the detailed steps that help me resolved my issues.
When I go to my Horizon View Dashboard, it looks fine.
When I try to remove the vCenter entry under the Server options and adding it back I end up with another error when trying to add the View Composer.
However this is not related to the strange behaviour above. But rather this is due to my login did not contain a domain\username but instead of use just username.
Back to the strange behaviour. It seems my connection to my vCenter via Connection Server has a sudden slowness and the certificate seems to be corrupted. I tried to find a solution to replace the self-signed (in my case) certificate on my View Connection Server however in vain. I tried removing the vCenter and re-adding it back, that does not help.
So I chanced upon some steps by our internal team and use it to resolve my problem and it works.
In summary, this is what was done. First we backup the ADAM database and then we invalid the entry of the vCenter in View Connection Server. Then we try to add the existing vCenter again. So now we have two entry of the vCenter where oneis an invalid entry. Taking from the valid entry certificate thumbprint, we overwrite the invalid ones and remove the latter vCenter entry. Next revert back the entry to previous valid entry.
Here are the detailed steps that help me resolved my issues.
To manually regenerate data:
Note: Back up the ADAM database before proceeding. For more information, see Performing an end-to-end backup and restore for View Manager (1008046).
Note: Back up the ADAM database before proceeding. For more information, see Performing an end-to-end backup and restore for View Manager (1008046).
- Log in to the machine hosting your View Connection Server. If there is a cluster of View Connection Servers, this step can be done on any of the servers.
- Click Start > Run, type cmd, and click OK. The command prompt opens.
- Run this command, substituting a name for your back up file.
vdmexport > ViewBackupFilename.ldf
- Connect to the ADAM database. For more information, see Connecting to the View ADAM Database (2012377).
- Expand OU=Properties > OU=VirtualCenter.
Note the entry is is after expanding the OU=VirtualCenter. - Document the first four characters of the vCenter Server entry, for example CN=f030. Right-click the vCenter Server entry and click Properties.
- Document these three values:
- pae-NameValuePair. Note the entry here and then remove it.
- pae-SVIURL. Note the entry and set to a value similar to https://OFFvComposer.domain.com:18443
- pae-VCURL. Note the entry and set to a value similar to https://OFFvCenter.domain.com:443/sdk
- In the View Administrator portal, refresh the dashboard to confirm the name change you made.
Do note that changes are reflected at two different location. - In View Configuration > Servers > vCenter Server, add an entry for the proper
- Open the properties page for each vCenter Server entry.
- Manually copy these values from the new vCenter Server entry to the old vCenter Server entry:
Note: Take a note of the entries before copying. When copying these values, copy and paste directly between properties sheets or copy to a plain text editor that does not add any formatting such as Windows Notepad.exe.
- pae-SVISslCertThumbprint
- pae-SVISslCertThumbprintAlgorithm
- pae-SVIUserName
- pae-SVIUserPassword
- pae-VCSslCertThumbprint
- pae-VCSslCertThumbprintAlgorithm
- pae-VCUserName
- pae-VCUserPassword
- Remove the new vCenter Server entry from the View Administrator webpage.
- Undo the three changes you made at the beginning of the process, including adding the UNIQUEID=XX value back into pae-NameValuePair and rename the pae-SVIURL and pae-VCURL.
- Reboot all Connection Servers in the replicated group.
- In the View Administrator webpage, refresh the Dashboard page again and confirm vCenter Server and Composer are both shown correctly and are now showing as green status.
- Proceed with testing provisioning and recomposing, as well as login functionality.
Comments