P2V / Upgrade fail -- "Unable to enumerate and validate the root certificates from the TRUSTED_ROOTS VECS store."

[spoovy]

I'm trying to upgrade from a Windows VCS (6.5) to VCSA (6.7).   Falling at the first hurdle though -- the migration assistant, run on the Windows VCS fails with:

Error: Unable to enumerate and validate the root certificates from the TRUSTED_ROOTS VECS store.

Resolution: Make sure that the vmafd service is reachable and started before continuing.

The VMware afd service is running though (it runs as a Windows service, "Local System" user).  I have tried the usual, restarting service to no avail.  The service does have "Allow service to interact with desktop" selected. Under the vSphere Web Client / Root Certificates I can see the normal CA cert (VMware Engineering) which is not expired and looks fine.

No idea why this isn't working (I'm not really a Windows guy), so any pointers appreciated.

[AlexJudge]

Has anyone found a solution to this issue? I'm seeing the same error...

[msripada]

sent PM ...pls check

[PattersonS]

Same error in an upgrade from 6.5 to 6.7 U2 VCSA.

I checked all stores and verified all logins, even connected to vCenter prior to access Certs. No luck, cannot finish Step 2 of Upgrade.

[msripada]

can you share me the output of trusted store as  a pm...

Thanks,

MS

[PattersonS]

Not allowing me to PM. Red bar at bottom. Problems with VMware community site all day.

[PattersonS]

Ok new work around, at least in my situation. We are HPE Nimble, and although the Cert is up to date, it's not liked by VMware, not in this case at least. Nimble has VMware integration that install the cert, simple unregister the integration plugins via Nimble and the task will be able to complete correctly. Then once complete, re-register the Web Client and VASA providers (VVols).

Check your External Plugins. For me it was a SANs integration.

[deathwishcoffee]

I am also having this issue.  Could you please send me the commands?

[johager]

Strange, that this failure only happens with Update 2 of vCenter 6.7. All forum questions i found dated after April 2019. After i changed the installation medium from vCenter 6.7 U2a to vCenter 6.7 U1b and retried the Upgrade the error was gone.

So i assume its a 6.7 U2 problem. Just try it with 6.7 U1 and perhaps the upgrade will continue.

[Kage_no_Gundan]

Fellow HPE Nimble admin here.  I ran into the same thing.  Thanks for pointing this out; unregistering only the VASA provider did it for me, which is worrying as VASA registration prevented SRM w/ABR from running on our server infrastructure.

[ASobolev]

Сan you send me commands to? I try to migrate Windows vCenter Server 6.5u1 to VCSA 6.7u3b and get the same error as in the topic.