Cannot export vLCM image if you use a custom SSL cert (Non-Microsoft)

[mbartle]

I have had a ticket open with support for almost 6 weeks now. The issue is :

If you import a custom machine SSL cert (in my case from GoDaddy) to your vCenter, you cannot export any images (either zip, ISO or JSON) from a cluster.  It throws the following error 

This site can’t provide a secure connection

test-vcenter.blah.ca sent an invalid response.

• Try running Windows Network Diagnostics.

ERR_SSL_PROTOCOL_ERROR

The only way I have been able to export images has been to create a new vCenter, let it use the self-signed certificate, then create a dummy cluster with no hosts, create an image and export it.  This works just fine.  We have a test vCenter plus a prod copy both using unique certs from GoDaddy and both experience same issues (7.02 and 7.03 versions)

Support can't seem to figure this out yet.  Can someone do me a favor please.  If you have a vCenter with a custom SSL cert, can you create a test cluster, create an image and see if it lets you export it ?  I'm just curious if this happens with anyone else.

[toprockRS]

23396619701

[rgb99]

@depping, My active one is 22390424612. Thank you!

[pmichelli]

@depping Here is the original SR that I opened a year ago when we discovered you cannot export the images if you use custom certs.  SR 21256084609

[depping]

thanks everyone, it appears there is an open bug on this, I am having the SRs attached to the bug.

[pmichelli]

Thank you Duncan.  This is such an extremely useful feature to have.  I manage some clusters with solutions that cannot be converted to vLCM managed.  The ability to export the same images for compliance and consistency is extremely useful.

Really appreciate you getting this escalated.  Hopefully it gets patched into the next vCenter 7.0.3 build

[rgb99]

Thank you. I hope this gets resolved sooner than later. Using VUM to update vSphere 7 hosts is not suitable due to all the extra components it thinks the host needs. Using an exported vLCM image and updating via iso/zip is our preferred way and currently, the bug is a major blocker for us.

[rgb99]

Support provided a "workaround," but for HPE. I tried to do the same thing for the DEL addon component but the trouble still remains. Waiting to hear back from them.

1. Below are the workaround steps:
   
   In VC, unzip HEP-ESXi-7.0-Addon-cumulative_metadata.zip and make the following changes to qlnativefc-8970347086672754435.xml file.
   
   Before:
   
   <system-requires>
   <maintenance-mode>true</maintenance-mode>
   </system-requires>
   
   After:
       
   <system-requires>
   <maintenance-mode>true</maintenance-mode>
   <softwarePlatform locale="" productLineID="embeddedEsx" version="7.0"/>
   </system-requires>
   
   
2. Zip all the files back to HEP-ESXi-7.0-Addon-cumulative_metadata.zip and replace the original one.
   
   
3. Restart vLCM service.
   
   
4. Export image and check if the same error still exists.
   
   

And then my response:

I was able to find the DEL addon component since we don't use HPE.

/storage/updatemgr/patch-store/hostupdate/DEL/DEL-ESXi-7.0-Addon-cumulative_metadata.zip

After unzipping the file, I edited qlnativefc--7865135011874587004.xml. That contains the info for MVL_bootbank_qlnativefc_5.3.2.0-1OEM.703.0.0.18644231, the problem vib. Then, I zipped it back together and copied it to the original directory.

zip -r /tmp/DEL-ESXi-7.0-Addon-cumulative_metadata.zip addons/ bulletins/ vendor-index.xml vibs/ vmware.xml

cp DEL-ESXi-7.0-Addon-cumulative_metadata.zip /storage/updatemgr/patch-store/hostupdate/DEL/

After restarting the 'VMware vCenter Life Cycle Management' service via VAMI, the export of the image still hung up.

[rgb99]

I tried something I haven't done before. I downloaded Dell Addon for ESXi 7.0U3 from https://customerconnect.vmware.com/downloads/details?downloadGroup=ADDON_ESXI70U3_DELLEMC&productId=...and imported it into vCenter. After that, I was able to export an image. I couldn't believe it!

ESXi Version: 7.0 U3j - 21053776
Vendor Addon: Dell addon for PowerEdge Servers running ESXi 7.0 U3 A09
Components: Dell EMC OpenManage Server Administrator, 11.0.0.0.5139

I don't know if importing after the XML edit was the key, or if it'll work if you only import the zip. Give it a try! I'm glad I can start updating some hosts again.

[pmichelli]

OMG you are a genius !!! 

I downloaded the A09 update for Dell EMC 7.0.3, imported it into Lifecyle Manager, then built an ISO with it and it let me export it !!

I didn't have to unzip or do any of the above steps. It seems the bundle VMware had was corrupted. I wasn't sure if this had uploaded correctly as I did not see a new category for it. I saw the normal Dell EMC ESXi 7.0.3, clicked the drop down, selected A09 - Validate - Save - Export

I'd buy you a beer if you lived near me ! Thanks for digging into this for us.

I did this on vCenter 7.0.3j and that stupid bug where you had to change the port to 9087 is gone as well !! It exported just fine with my GoDaddy SSL cert without me needing to change ports

[rgb99]

That's fantastic. I also noticed the port bug was addressed at some point -- only exporting was the issue. Now, after re-importing the bundle, exporting works as expected again. Finally! 😁

[pmichelli]

A10 is out and it is doing the same as A09. Will not export ISO images but A09 (that we manually imported does). The link you gave me has A10 available for download.  You have to import it like we did for A09 and then you can export images again.

Just a heads up @rgb99 

[rgb99]

Yup! That did the trick once again. Thanks! 😄

[pmichelli]

vCenter 7.0.3k just released and I can confirm, it does not fix the bug.  You still need to manually import the A09/A10 bundles for it. Maybe next build ! 

[MarioLenz]

It looks like the Dell addon A11 is out (Release Date: 2023-05-23), maybe this one finally works.

However, as far as I can see it's not yet on hostupdate.vmware.com for vSphere Lifecycle Manager / UMDS to download it automatically. Does anyone know how long it usually takes for a new version of the addon to published there?

[vrathna]

Please try suggested workaround https://kb.vmware.com/s/article/91237 

[pmichelli]

I can't believe they finally created a KB article to acknowledge this bug.  The workaround works, we've been using it for months.  Would be nice to have this resolved once and for all without needing these steps

[pmichelli]

A11 is there now. I just downloaded it