Custom ISO fails at Export-ESXImageProfile with a seemingly SSL-related issue

[Matrices07]

Hello all,

This is part two of my original attempt at injecting a community nvme fling driver into my v8 ESXi image.

@knikolov was awesome enough to point me in the right direction on my Python issue - thanks again!

I've now stepped through the process of :

set-ExecutionPolicy -ExecutionPolicy AllSigned

add-EsxSoftwareDepot -DepotUrl https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

add-EsxSoftwareDepot -DepotUrl .\pkgdir\nvme-community-driver_1.0.1.0-1vmw.670.0.0.8169922-offline_bundle-17658145.zip (not sure if there is a way to pull flings from a URL)

new-EsxImageProfile -CloneProfile ESXi-8.0.0-20513097-standard -Name "ESXi-8-nvme"

Export-ESXImageProfile -ImageProfile "ESXi-8-nvme" -ExportToISO -filepath .\ESXi-8-nvme_mod.iso

It's at this last step that I encounter : 

Export-ESXImageProfile : [PEM: NO_START_LINE] no start line (_ssl.c:2460)
At line:1 char:1
+ Export-ESXImageProfile -ImageProfile "ESXi-8-nvme" -ExportToISO -file ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Export-EsxImageProfile], FaultException
+ FullyQualifiedErrorId : System.ServiceModel.FaultException,VMware.ImageBuilder.Commands.ExportProfile

Judging by the errors involving PEM and the _ssl, my first assumption was that it might be related to the other SSL cert issues that I've seen in other threads about connectivity.  However, the machine that I am running PowerCLI on does not have Vsphere, Workstation, or  other VMware-related installations on it.  I don't have an ESXi / Vsphere installation up and running yet - I'm still trying to create the ISO to install one haha.

On a whim, I checked the local and personal Certificate Authority on my machine to see if I *did* have any VMWare-related certs installed.  I found a pair under Current User : Trusted Publishers.  One was issued by DigiCert and the other, by Symantec.  The Symantec one expired in 2021.

For information sake, I have a Win 11 machine running Powershell version 5.1.22621 .  I'm running v13 of VMware.PowerCLI and v8.0.0.2 of VMware.ImageBuilder.

Any thoughts, suggestions, or otherwise would be greatly appreciated.

Thanks!

[lamw]

I actually ran into this issue earlier this week and have already reported it internally, waiting to hear back from PowerCLI team. I also saw that other folks ran into same problem, so there could be an issue with Image Builder cmdlets and/or compatibility in creating ESXi 8.0 Images ... For now, you can use Image Builder UI OR vLCM https://williamlam.com/2022/11/creating-custom-esxi-images-using-vsphere-lifecycle-manager-vlcm-ui-a...  

[garnt]

Also having an issue with esxi7 so not isolated to 8

[chall32]

Seems to be a PowerCLI v13 issue. 

Works fine for v7.0U3i with PowerCLI v11.2 (yeah old version, but it's all I had to hand to test with!!) 

[lamw]

Yes, this is indeed specific to PowerCLI 13 and doesn't matter which version of ESXi you attempt to export to ISO. I had posted https://williamlam.com/2022/11/heads-up-unable-to-open-vib-archive-in-streaming-mode-using-export-es... and have already reported this internally but there's no workaround using PowerCLI at the moment and earlier suggestion is still applicable for the time being if you need to create an ESXi image profile

[chall32]

Nice one, thanks William 👍 

[VIR2AL3X]

I too am facing this exact same issue but only when running on macOS or Linux...working fine for me with Windows 11...

```TerminatingError(Export-EsxImageProfile): "[PEM: NO_START_LINE] no start line (_ssl.c:2570)"```

[nick_heaton]

I found a workaround for at least MacOS, may work on other platforms.

Append a '-NoSignatureCheck' to the end of the Export-EsxImageProfile like so. It worked for me, hopefully it works for you too.

Export-EsxImageProfile -ImageProfile "Intel NUC 7.0U3i" -ExportToIso -FilePath '/Users/Name/Downloads/IntelNUC_esxi_70u3i.iso' -NoSignatureCheck

[nick_heaton]

I tried using this for ESXi v8.x and kept getting an error "Export-EsxImageProfile: [Errno 54] Connection reset by peer"

To work around this, I Uninstalled v13 of the module and installed v12 instead.

# Bug in PowerCLI v13.x.x preventing writing of ISO

pwsh

Uninstall-Module -Name VMware.PowerCLI

Install-Module -Name VMware.PowerCLI -Maximumversion 12.9.9

Set-PowerCLIConfiguration -PythonPath /usr/local/bin/python3.7 -Scope User

Add-EsxSoftwareDepot -DepotUrl https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/vmw-depot-index.xml

New-EsxImageProfile -CloneProfile ESXi-8.0a-20842819-standard -Name "Intel NUC 8.0a"

Add-EsxSoftwareDepot -DepotUrl '/Users/user/Downloads/ESXi800-VMKUSB-NIC-FLING-61054763-component-20826251.zip'

Add-EsxSoftwarePackage -ImageProfile "Intel NUC 8.0a" -SoftwarePackage vmkusb-nic-fling

Export-EsxImageProfile -ImageProfile "Intel NUC 8.0a" -ExportToIso -FilePath '/Users/user/Downloads/IntelNUC_esxi_80a.iso' -NoSignatureCheck

[aaaapk]

我也遇到一样的问题，采取了以下错误： 1、卸载了VMware.PowerCLI 的 v13.0.0 2、安装VMware.PowerCLI 的 v12.0.0 就能正常进行自定义iso了，看有人说是由于VMware.PowerCLI 的 v13.n.n版本的问题，可惜没有去测试其他13.n.n的版本。

[Butch0379]

Short answer is you need to use Windows to do a custom ISO still.

I met with 1 of the PowerCLI team leads at VMware Explore US 2023. They admitted that they found an issue with using other OSs to make Custom ISOs and that they would be releasing a new version of PowerCLI that has the fix in it. If you have API support, file a case. Apparently they have a beta fix out already, but have not done this yet.

I have been holding out for the update that should be out anytime now.