Hi all,
I understand vRA 8 is very much in its beginnings, but figured it was worth a shot asking this with some of the other brave pioneers with the arrows in their backs out there.
I deployed a simple vRA 8 environment in my lab and I'm trying to apply a new certificate to it. I added a wildcard certificate (with a proper public suffix) to LCM Locker, and the PEM I imported passed validations. I used this certificate to update the LCM instance itself, as well as the IDM instance with no issue. For the IDM instance I used the LCM workflow. I then tried to apply the certificate to the vRA environment via LCM but received the following error:
com.vmware.vrealize.lcm.common.exception.EngineException: Failed to install vRA Certificate on hostname : testvra.lab.net
at com.vmware.vrealize.lcm.plugin.core.vra80.task.VraVaInstallCertificateTask.execute(VraVaInstallCertificateTask.java:135)
at com.vmware.vrealize.lcm.plugin.core.vra80.task.VraVaInstallCertificateTask.retry(VraVaInstallCertificateTask.java:220)
at com.vmware.vrealize.lcm.automata.core.TaskThread.run(TaskThread.java:43)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Did some digging and it appears the LCM workflow copies the PEM over to the /tmp directory on the vRA appliance and runs a command similar to:
vracli certificate ingress --set /tmp/lcm-cert.pem --sha256 {value}
I tried running this command while SSH'ed into the vRA appliance and got the following error:
Certificate with sha256 sum: {value} have errors in section 'v3_extensions'["Unable to parse certifcate's ['v3_extensions']['critical'] section. "
Popped open the cert and didn't see anything unusual:
![]()
I've tried a couple other things such as deleting the critical section, creating a dedicated cert instead of a wildcard, and changing the hashing algorithm but to no effect. I'm thinking that this error might be a red herring, but not sure.
Figured I'd ask to see if anyone else had any issues with theirs. If I stumble upon the answer, I'll update my thread.