SSL Certificate Automation tool error level 3?

[burdweiser]

So I'm working off KB 2041600. I am attempting to upgrade certificates on two separate vCenter servers and I am getting the same error "Cannot determine if Inventory Service is registered with Single Sign-On - errorlevel is 3" while upgrading my inventory certificate. See full log below*

I am 100% positive my certificates are correct. I have used Derek Seamons scripts in the past to generate my certificates and it has worked for other vCenter servers. I was able to complete step 1 and replace the certificate for SSO. I am just stuck on the inventory service now. I have opened a support case as well.

==================================================================

4. Update the Inventory Service SSL Certificate

     1. Update the Inventory Service Trust to Single Sign-On

     2. Update the Inventory Service Trust to vCenter Server

     3. Update the Inventory Service SSL Certificate

     4. Rollback to the previous Inventory Service SSL Certificate

     5. Return to the main menu to update other services

The chosen service is: 1

[Thu 06/26/2014 - 14:51:26.61]: The services that are restarted as a part of thi

s operation are: vCenter Inventory Service.

[Thu 06/26/2014 - 14:51:57.01]: Last operation update Inventory Service trust to

Single Sign-On completed successfully.

[Thu 06/26/2014 - 14:51:57.01]: Go to the next step in the plan that was receive

d from Update Steps Planner.

==================================================================

4. Update the Inventory Service SSL Certificate

     1. Update the Inventory Service Trust to Single Sign-On

     2. Update the Inventory Service Trust to vCenter Server

     3. Update the Inventory Service SSL Certificate

     4. Rollback to the previous Inventory Service SSL Certificate

     5. Return to the main menu to update other services

The chosen service is: 2

[Thu 06/26/2014 - 14:53:50.92]: The services that are restarted as a part of thi

s operation are: vCenter Inventory Service.

[Thu 06/26/2014 - 14:54:23.93]: Last operation update Inventory Service trust to

vCenter Server completed successfully.

[Thu 06/26/2014 - 14:54:23.95]: Go to the next step in the plan that was receive

d from Update Steps Planner.

==================================================================

4. Update the Inventory Service SSL Certificate

     1. Update the Inventory Service Trust to Single Sign-On

     2. Update the Inventory Service Trust to vCenter Server

     3. Update the Inventory Service SSL Certificate

     4. Rollback to the previous Inventory Service SSL Certificate

     5. Return to the main menu to update other services

The chosen service is: 3

[Thu 06/26/2014 - 14:54:47.90]: The services that are restarted as a part of thi

s operation are: vCenter Inventory Service.

Enter the location to the new Inventory Service SSL cert file (default value is:

C:\Certs\Inventory\chain.pem):

Enter the location to the new Inventory Service private key (default value is: C

:\Certs\Inventory\rui.key):

Enter the Single Sign-On Administrator user (default value is: admin@system-doma

in):

Enter the Single Sign-On Administrator password (will not be echoed):

[.] WARNING: Certificate's `CN=vcenter01.burdweiser.com, OU=vCenterInventoryService,

O=Burdweiser, L=Houston, ST=TX, C=US' signature uses weak one-way hash (SHA

-1). In a secure environment it is recommended to use SHA2-256 or a stronger has

h algorithm.

[.] The supplied certificate chain is valid.

[Thu 06/26/2014 - 14:55:14.12]: Last operation update Inventory Service SSL cert

ificate failed :

[Thu 06/26/2014 - 14:55:14.14]: Cannot determine if Inventory Service is registe

red with Single Sign-On - errorlevel is 3

[burdweiser · Accepted solution]

In my case, I was attempting to replace certificates before an upgrade from 5.1 to 5.5. The easiest route taken was to uninstall SSO and the inventory service, then proceed with the upgrade to 5.5. After that, replace the certificates.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=205734...

[interpipes]

Having just gone through this, and gone down the rabbit hole a bit further and trying to install the cert by hand outside of the tool, it turns out that Errorlevel 3 means that your SSO admin credentials were not accepted. Either they're wrong, or, more likely if you just managed to replace the SSO SSL cert with them, they're expired (default max password age is 1 year); it seems that SSO's admin credential password expiry policy suddenly comes into play for anything other than manipulating the SSO SSL cert itself.

In theory, you should be able to change the password following the instructions in

Resetting an expired password in vCenter Single Sign-On (SSO) (2035864)

However, in the event that you can't get that to take for some reason, simply extend the expiry by manipulating the SSO DB as per:

Logging in to the vSphere Web Client using admin@system-domain fails with the error: associated user...