Hi guys,

Last week, when I try to login to VCSA, it seem something wrong and I can't login. So I try to reboot the VCSA.

When it boot up,the website only show the text below:

503 Service Unavailable (Failed to connect to endpoint: [N7Vmacore4Http20NamedPipeServiceSpecE:0x00007f285000c480] _serverNamespace = / action = Allow _pipeName =/var/run/vmware/vpxd-webserver-pipe)

And there is a lot of service can not be started.

root@dr-vcsa [ ~ ]# service-control --status

StartPending:

vmware-perfcharts

Stopped:

pschealth vmcam vmware-content-library vmware-eam vmware-imagebuilder vmware-mbcs vmware-netdumper vmware-rbd-watchdog vmware-sps vmware-statsmonitor vmware-updatemgr vmware-vapi-endpoint vmware-vcha vmware-vpxd vmware-vpxd-svcs vmware-vsan-health vmware-vsm vsan-dps

Running:

applmgmt lwsmd vmafdd vmcad vmdird vmdnsd vmonapi vmware-analytics vmware-certificatemanagement vmware-cis-license vmware-cm vmware-pod vmware-postgres-archiver vmware-rhttpproxy vmware-sca vmware-sts-idmd vmware-stsd vmware-topologysvc vmware-vmon vmware-vpostgres vsphere-client vsphere-ui

What should I do?

Hi,

You can follow these kb

• VMware Knowledge Base
• VMware Knowledge Base

ARomeo

first check if there is enough space left on the partitions - there must be free space escept on the /storage/archive

then try to start services manually and look in the correspondent logs for errors

Moderator: Moved to vCenter Server

It may have been a case of your browser remembering forms, sometimes with these errors it's worth trying another browser or enabling incognito mode. I had similar when deploying SRM.

https://www.chrisdooks.com/2019/07/18/installing-srm-8-2-appliance-error-a-specified-parameter-was-not-correct-connection-thumbprint/

What version are you on?

VMware Knowledge Base - there are some really useful commands in this KB article.

Have you opened a GSS case?

If half of the services are not running its no surprise that vCenter isnt usable.  Your post lacks some information like VCSA version or how "old" the installation is. Is it a 6.0/6.5 than most likely one of your partions runs out of space (try to login and run df -h) in /storage/log or similar.

Check if DNS and Gateway  accessable from the VCSA because a 6.7 doenst restart without.

If you have planed a vHW upgrade by accident? If so revert to vHW10 .

If you have SnS you should call GSS.

Regards,
Joerg

One of the partitions will be full and/or root account password expired is my bet.

Sorry if I missed it but where does it say in the document that it can be re-linked AFTER it is split up once already?

As you see my post below, I already re-linked but cant access VCSAs anymore.

Yes i tried the incognito mode, not working. But i already migrated everything by hand. Its resolved eventually. Everything is up and running.

Hi Guys!

Im able to succesfully migrate from 6.7 to 7.0. Everything is up and running.

Now i want to use my company signed wildcard certificate for the web client for avoid SSL error in browser.

Probably this is where is messed up the 6.x badly, so anyone can help me out?

As i understand i need the solution user certificate, the fifth menu option in the console certificate manager. Right?

If i replace the machine cert the whole system messed up, i figured out already. So this is a clean and fresh system, everything is working. I really dont want to mess up this part again, but we need the signed cert.

Thanks!

It doesn't support wildcard certificates. You need to use CN/SAN certificates instead.

This would be a problem. We only have the wildcard since that is cover everything. Are you sure its not gonna work? Its the same PEM format like with the CN.

Correct, wildcard certificates are not supported in vSphere as they have never been. 7.0 does not change that.

Hi

im considering upgrade my vcenter server from 6.5u3g(15505374) to vcenter 6.7u3f(15976714).

i read the "back in time release upgrade restrictions (kb67077)" i looked over the matrix and noticed that my vcenter is not upgadable.

i check the release dates of the version and i can see that my vcenter has no "back in time" secnario. (and yet, it appears as no upgradeble at the matrix.)

my vcenter version and release date: vcenter 6.5U3g 15505374 released 1/30/2020.
the latest vcenter version and release date:vcenter 6.7 15976714 released 4/9/2020.

do i miss something?

i have to make sure before any progress on my evvironment.

thanks for your help

Dor

Important: Upgrade from vCenter Server 6.5 Update 3f and above to vCenter Server 6.7 Update 3f is not supported. For more information on vCenter Server versions that support upgrade to vCenter Server 6.7 Update 3f, see VMware knowledge base article 67077.

You could check this link: VMware vCenter Server 6.7 Update 3f Release Notes

You can compare the matrix from 6.5 to 6.7..

VMware Knowledge Base

Vmware surely have an SSL fetish...

I cant even use a reverse proxy above the vcenter server. If i use a different hostname vcenter rewrite to its own. If i use the same hostname its drop me http 400 error.

Im export the root CA and import to the browsers. This is the only way if we dont want to purchase an individual ssl just for the vcenter. I rather stay away from the whole SSL part and leave it untouched in vcenter. I guess i will have a problem when the self signed cert will expire 2 years from now XDD

What is bad i cant reach anybody on the support. The local support line is dead, nobody answer it, im opened a support ticket not answered since a week. I know the coronavirus rewrite almost everything but this is not acceptable.

Anyway its solved now with importing the CA to the browsers. Its not a solution its a workaround, but its works. Enough, for now.

Thank for all answer. I have already solve my probem.

And its a certificate problem, the certificate of VCSA is expired. Somehow it infect the service, meaning time the service in not running,I can not change my certificate.

My solution is:

Reboot the VSCA. And run

/usr/lib/vmware-vmca/bin/certificate-manager

Choose the option 8 to reset all certificate,and reboot again.

Then the service return to normal, and I can change my certificate again.

[root@clientVM1 lin64]# ./vcsa-deploy install /root/vcenter/config/embedded_vCSA_on_ESXi.json --accept-eula --no-esx-ssl-verify --no-ssl-certificate-verification --log-dir=/root/vcenter/log

Run the installer with "-v" or "--verbose" to log detailed information

Updating log file location, copying '/tmp/vcsaCliInstaller-2020-04-21-03-14-69v3uwr0/vcsa-cli-installer.log' to desired location as a backup: '/root/vcenter/log/workflow_1587438887538/vcsa-cli-installer.log.bak'

Consuming the installer build:15393115

Workflow log-dir /root/vcenter/log/workflow_1587438887538

=================================================== [START] Start executing Task: To validate CLI options at 03:14:47 ===================================================

Command line arguments verfied.

========= [SUCCEEDED] Successfully executed Task 'CLIOptionsValidationTask: Executing CLI optionsValidation task' in TaskFlow 'template_validation' at 03:14:47 =========

=========================================== [START] Start executing Task: To validate the syntax of the template. at 03:14:47 ===========================================

Template syntax validation for template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' succeeded.

Syntax validation for all templates succeeded.

======== [SUCCEEDED] Successfully executed Task 'SyntaxValidationTask: Executing Template Syntax Validation task' in TaskFlow 'template_validation' at 03:14:47 ========

[START] Start executing Task: To check the version of each template, and for each older template that supports CEIP, convert it to the latest template format, and save

it to the Template Blackboard at 03:14:47

CEIP is not enabled because the template key 'ceip_enabled' in section 'ceip', subsection 'settings' in template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' was

set to 'false'.

CEIP is not enabled because the template key 'ceip_enabled' in section 'ceip', subsection 'settings' in template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' was

set to 'false'.

CEIP is not enabled because the template key 'ceip_enabled' in section 'ceip', subsection 'settings' in template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' was

set to 'false'.

Template version processing for template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' succeeded.

Version processing for all templates succeeded.

======= [SUCCEEDED] Successfully executed Task 'VersionProcessingTask: Executing Template Version Processing task' in TaskFlow 'template_validation' at 03:14:47 =======

============= [START] Start executing Task: To validate the template structure against the rules specified by a corresponding template schema. at 03:14:47 =============

Template structure validation for template '/root/vcenter/config/embedded_vCSA_on_ESXi.json' succeeded.

Structure validation for all templates succeeded.

===== [SUCCEEDED] Successfully executed Task 'StructureValidationTask: Executing Template Structure Validation task' in TaskFlow 'template_validation' at 03:14:47 =====

[START] Start executing Task: To create a dependency graph for the provided templates, with an edge pairing two templates that are dependent on each other. Such graph

relationships will affect whether certain templates can be deployed in parallel, or must be deployed sequentially. at 03:14:48

Dependency processing for all templates succeeded.

==== [SUCCEEDED] Successfully executed Task 'DependencyProcessingTask: Executing Template Dependency Processing task' in TaskFlow 'template_validation' at 03:14:48 ====

=================================== [START] Start executing Task: Validate that requirements are met in the source VCSA. at 03:14:48 ===================================

InstallRequirementCollector: Reached gathering requirement

================ [SUCCEEDED] Successfully executed Task 'SrcRequirementTask: Running SrcRequirementTask' in TaskFlow 'embedded_vCSA_on_ESXi' at 03:14:48 ================

=================================================== [START] Start executing Task: Perform precheck tasks. at 03:14:49 ===================================================

============================ [START] Start executing Task: Verify that the provided credentials for the target ESXi/VC are valid at 03:14:49 ============================

The certificate of server '1.2.3.4' will not be verified because you have provided either the '--no-ssl-certificate-verification' or '--no-esx-ssl-verify' command

parameter, which disables verification for all certificates. Remove this parameter from the command line if you want server certificates to be verified.

============================ [SUCCEEDED] Successfully executed Task 'Running precheck: TargetCredentials' in TaskFlow 'install' at 03:14:49 ============================

============================== [START] Start executing Task: Verify the target host type matches the one given in the template at 03:14:49 ==============================

============================== [SUCCEEDED] Successfully executed Task 'Running precheck: TargetHostType' in TaskFlow 'install' at 03:14:49 ==============================

========================== [START] Start executing Task: Verify that the target ESXi or VC version meets the minimum requirements at 03:14:49 ==========================

============================== [SUCCEEDED] Successfully executed Task 'Running precheck: TargetVersion' in TaskFlow 'install' at 03:14:49 ==============================

================================ [START] Start executing Task: Validate that the OVA image has the required OVA properties. at 03:14:50 ================================

============================== [SUCCEEDED] Successfully executed Task 'Running precheck: OVAProperties.' in TaskFlow 'install' at 03:14:50 ==============================

====================================== [START] Start executing Task: Validate the provided ip/fqdn is available to use at 03:14:50 ======================================

Pinging IPv4 address 5.6.7.8

5.6.7.8 seems not in use.

Pinging IPv4 address vcenter1.esxi1.lab

Pinging IPv4 address vcenter1.esxi1.lab

Pinging IPv4 address vcenter1.esxi1.lab

5.6.7.8 seems not in use.

=============================== [SUCCEEDED] Successfully executed Task 'Running precheck: IpFqdnInUse' in TaskFlow 'install' at 03:15:34 ===============================

===================== [SUCCEEDED] Successfully executed Task 'Running precheck: LinkingTargetHostnameValidation' in TaskFlow 'install' at 03:15:35 =====================

========================================= [START] Start executing Task: Validate the target ESXi management status at 03:15:35 =========================================

=========================== [SUCCEEDED] Successfully executed Task 'Running precheck: ESXManagementStatus' in TaskFlow 'install' at 03:15:35 ===========================

============================== [START] Start executing Task: Precheck CPU, memory and datastore size requirements for a host. at 03:15:35 ==============================

=============================== [SUCCEEDED] Successfully executed Task 'Running precheck: HostConfigs' in TaskFlow 'install' at 03:15:37 ===============================

=============================== [START] Start executing Task: Validate the provided target appliance name is available to use at 03:15:37 ===============================

============================== [SUCCEEDED] Successfully executed Task 'Running precheck: ApplianceName' in TaskFlow 'install' at 03:15:37 ==============================

============================================================== [START] Start executing Task:  at 03:15:37 ==============================================================

============================================== [SUCCEEDED] Successfully executed Task '' in TaskFlow 'install' at 03:15:37 ==============================================

====================== [START] Start executing Task: Check whether the datastore's free space accommodate the VCSA's deployment option at 03:15:38 ======================

============================ [SUCCEEDED] Successfully executed Task 'Running precheck: TargetDsFreespace' in TaskFlow 'install' at 03:15:38 ============================

=========================== [START] Start executing Task: Verify the provided SSO info is valid by connecting to the STS service. at 03:15:38 ===========================

============================== [SUCCEEDED] Successfully executed Task 'Running precheck: SSOCredentials' in TaskFlow 'install' at 03:15:38 ==============================

============================= [START] Start executing Task: Verify that the provided external SSO (PSC)/Embedded info is valid at 03:15:38 =============================

=============================== [SUCCEEDED] Successfully executed Task 'Running precheck: SSOExternal' in TaskFlow 'install' at 03:15:38 ===============================

======================= [SUCCEEDED] Successfully executed Task 'PrecheckTask: Running prechecks.' in TaskFlow 'embedded_vCSA_on_ESXi' at 03:15:38 =======================

=========================== [START] Start executing Task: Invoke OVF Tool to deploy VCSA for installation, upgrade, and migration at 03:15:39 ===========================

OVF Tool: Opening OVA source: /mnt/cdrom/vcsa-cli-installer/lin64/../../vcsa/VMware-vCenter-Server-Appliance-7.0.0.10100-15934039_OVF10.ova

OVF Tool: The manifest validates

OVF Tool: The provided certificate is in valid period

OVF Tool: Source is signed but could not verify certificate (possibly self-signed)

OVF Tool: Certificate information:

OVF Tool:   CertIssuer:/C=US/ST=California/L=Palo Alto/O=VMware, Inc.

OVF Tool:   CertSubject:/C=US/ST=California/L=Palo Alto/O=VMware, Inc.

OVF Tool:   -----BEGIN CERTIFICATE-----

OVF Tool:   ... <DELETED> ...

OVF Tool:

OVF Tool:   -----END CERTIFICATE-----

OVF Tool: Opening VI target: vi://root@1.2.3.4:443/

OVF Tool: Deploying to VI: vi://root@1.2.3.4:443/

OVF Tool: Disk progress: 99%

OVF Tool: Transfer Completed

OVF Tool: Powering on VM: Embedded-vCenter-Server-Appliance

OVF Tool: Task progress: 0%

OVF Tool: Task Completed

OVF Tool: Waiting for IP address...

OVF Tool: Received IP address: 5.6.7.8

OVF Tool: Completed successfully

====================== [SUCCEEDED] Successfully executed Task 'Deploying vCenter Server Appliance' in TaskFlow 'embedded_vCSA_on_ESXi' at 03:21:31 ======================

================================= [START] Start executing Task: Monitor the entire VCSA deployment using appliance REST API at 03:21:31 =================================

Checking if the target VCSA is powered on and ready for operations...

Successfully verified that the target VCSA 'Embedded-vCenter-Server-Appliance' has been powered on and is now ready for operations

Checking if the target VCSA appliance API is available for query

The certificate of server '5.6.7.8' will not be verified because you have provided either the '--no-ssl-certificate-verification' or '--no-esx-ssl-verify' command

parameter, which disables verification for all certificates. Remove this parameter from the command line if you want server certificates to be verified.

Where ,

1.2.3.4 - ESXi host

5.6.7.8 - vCenter IP

clientVM1 is on the another server , a RHEL VM created, which has access to the DNS server. Reverse mapping of DNS is also done on the DNS server.