Could not establish trust relationship for the SSL/TLS secure channel with authority

[sijumathew]

I get the above certificate error when I try to establish connection to the VI server via PowerShell script. Below is the command executed

Connect-VIServer -Server $hostName -User $userName -Password $password -ErrorAction SilentlyContinue -WarningAction SilentlyContinue

I have seen in several posts suggests ignoring the certificate error by running the following command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false

I am not sure if this is a proper fix. Are there any other alternate solutions (e.g. Download and install the certificate)?

[LucD]

The proper fix is of course is to use a valid certificate, not the self-signed one generated during the installation.

You could download the self-signed certificate and store it in the certificate store.

But that completely bypasses the purpose of a certificate imho.

You can just as well 'Ignore' the certificate in this case.

[sijumathew]

You mean install a valid certificate on the client? Where do I get the certificate from?

[LucD]

No, I mean a valid certificate on your servers.

See for example Use Custom Certificates With vSphere

If that is not possible, you can use the procedure in KB2108294 to download the self-signed certificate.

[sijumathew]

I've followed the instructions in KB2108294, un​ unfortunately I am not seeing the ' Download trusted root CA certificates' link. See the screenshot

The PowerCli version is VMware PowerCLI 11.2.0 build 12483598. Any idea?

[LucD]

That KB is for a vCenter, you seem to be looking at an ESXi node.

[cryton2707]

You have 4 options..

1. Suppress the warning about a certificate being invalid because its self signed (Generated)

2. Import these certificates to the local certificate as trusted certs.. (this will suppress the invalid cert warnings in the browser for vCenter )

3. Get a proper certificate generated by a Certificate authority (such as Comodo) for this you will need to generate a Certificate Signing Request and send of to your certificate authority.  Get back a Certificate and install on servers. You may want to add a subject alternative name to the CSR for the short name of the server as well as its FQDN for the CSR.

Remember that proper signed certs will also require proper management and updating at a later date and can produce their own headaches in that management.

4. Stay as you are and ignore the warning.

I personally do the following.

Set the following as my PowerCLI configuration.

Set-PowerCLIConfiguration -DefaultVIServerMode Multiple -InvalidCertificateAction Ignore -ParticipateInCeip $false -DisplayDeprecationWarnings $true -WebOperationTimeoutSeconds -1 -Scope AllUsers

and for vcenter Certs Import the root CA Certs from https://<vCenter Server>/certs/download.zip

For ESXi host Certs open the host ui in a web browser and right click the cert Icon and choose to Certificate information

from there you can save to file and have options to export the full certificate chain during that export and then import them P7B Trusted Certs on the local machine