TLS certificate validation in Virtualization Manager

Setting TLS validation is crucial for ensuring secure communication over networks. It helps verify the authenticity of the server you are connecting to, preventing attackers from impersonating trusted entities. TLS validation also encrypts data in transit, protecting sensitive information from being intercepted or tampered with. Without proper validation, systems are vulnerable to man-in-the-middle attacks and data breaches. Implementing TLS validation safeguards both the integrity and confidentiality of your connections.

SolarWinds® Observability Self-Hosted™ now includes support for secure authentication when communicating with VMware vCenter, VMware ESXi host, Nutanix Prism Element, and Nutanix Prism-Central.

After setting up TLS certificate validation, you may see the following error in the Java Poller logs “JavaWorker-unknown.log”, which can be found in C:\ProgramData\SolarWinds\JobEngine.v2\VimWorker\logs directory.

2025-04-10 10:19:15,921 [ViSdkExecutor-1] ERROR com.hyper9.data_collection.visdk.jobs.EnumerateEnvironmentJob - Connection to <ip address> failed due to problems with certificate. javax.net.ssl.SSLHandshakeException: Certificate thumbprint is not allowed <thumbprint of the certificate>

To establish a secure connection with the server, you can either reduce certificate checks - such as selecting one or two options like CheckOnCertificateChainErrors, CheckOnCertificateNameMismatch, or CheckOnCertificateRevocation—or provide an enhanced certificate.

This issue occurs due to the additional changes in Virtualization Manager (VMAN) 2025.2 and above related to TLS certificate validation, which can lead to insecure connections or communication failures between Virtualization Manager and virtual infrastructure components.

Option 1: Use a Valid Certificate

Ensure that the certificate must meet the following requirements:

• Issued by a trusted CA
• Has a CN matching the resource’s FQDN
• Has a complete chain
• Has a valid revocation path

Option 2: Modify Centralized Settings

1. Log in to the SolarWinds Platform Web Console as an administrator and go to the Advanced Configuration page. Adjust the SolarWinds Platform Web Console URL as follows: [hostname or ipaddress]/Orion/Admin/advancedconfiguration/global.aspx.
2. Under the SolarWinds.Orion.RemoteCertificateValidation section, select one or all of the following options and save the changes:
• CheckOnCertificateChainErrors– This option ensures the certificate path is validated by checking for the presence of the basicConstraints extension and confirming that the certificate chain ends with a trusted Certificate Authority (CA) certificate
• CheckOnCertificateNameMismatch - This is a security setting used in TLS certificate validation. It ensures that the hostname in the certificate matches the hostname of the server you are connecting to. If there is a mismatch, it indicates a potential security risk, as the certificate might not be valid for the server you are trying to reach.
• CheckOnCertificateRevocation - This ensures that a certificate is checked against a Certificate Revocation List (CRL) to verify that it has not been revoked before establishing a secure connection. This is an important step in maintaining the integrity and trustworthiness of SSL/TLS connections, as it helps prevent the use of compromised or invalid certificates.
3. Restart all services as required. Polling of the current virtual entities may fail, potentially causing disruptions that could lead to delays exceeding two hours.

If a self-signed certificate is only option, use the following steps below:

Set up VMware vCenter with self-signed certificate

1. Generate a Self-Signed Certificate: Use the VMware Certificate Authority (VMCA) or an external tool to create a self-signed certificate. Ensure the certificate includes the necessary details like the server's hostname and IP address.
   
   The certificate can only be generated based on the IP address, so it is essential to ensure that this IP remains consistent over time and does not vary across different networks.
2. Install the Certificate: Access the vCenter Server Appliance or Windows-based vCenter Server and use the Certificate Manager tool to install the self-signed certificate. This tool allows you to replace the default certificates with your custom ones.
3. Configure API Access: Update the vCenter settings to use the installed certificate for API communication. This ensures secure data exchange between vCenter and external systems.
4. Verify the Setup: Test the connection and API access to confirm that the certificate is correctly installed and functioning as intended.

This SWQL query can help you solve the problem:

-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT CertificateThumbprint, VCenterID, NodeID, Name, VMwareProductName,
VMwareProductVersion

FROM Orion.VIM.VCenters

If the CertificateThumbprint column contains only the certificate fingerprint, everything is fine; if not, this column contains the value "Invalid certificate <certificate fingerprint>".

For detailed instructions, you can explore resources like this guide.

Set up Vmware ESXi with self-signed certificate

1. Generate the Certificate: Use OpenSSL or VMware tools to create a self-signed certificate. Ensure the certificate meets VMware's requirements, such as PEM format and RSA keys.
   
   The certificate can only be generated based on the IP address, so it is essential to ensure that this IP remains consistent over time and does not vary across different networks.
2. Install the Certificate: Access the ESXi host via SSH or the vSphere Client. Replace the default SSL certificate with your custom self-signed certificate by uploading it to the appropriate directory.
3. Configure Host Settings: Update the ESXi host settings to use the new certificate for secure communication.
4. Verify the Setup: Test the connection to ensure the certificate is functioning correctly and secure.

This SWQL query can help you solve the problem:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT
hosts.CertificateThumbprint,
hosts.HostID AS ID,
hosts.NodeID,
hosts.DisplayName AS Name,
hosts.IPAddress
FROM Orion.VIM.Hosts AS hosts
INNER JOIN Orion.Nodes AS nodes ON hosts.NodeID = nodes.NodeID
WHERE hosts.ClusterID IS NULL AND hosts.DataCenterID IS NULL AND hosts.PlatformID = 1

If the CertificateThumbprint column contains only the certificate fingerprint, everything is fine; if not, this column contains the value "Invalid certificate <certificate fingerprint>".

For detailed instructions, you can explore resources like this guide.

Set up Nutanix Prism Central or Nutanix Prism Element with self-signed certificate

1. Generate a Self-Signed Certificate: Use OpenSSL or a similar tool to create a self-signed certificate. Include details like the hostname and IP address of the Prism Element or Prism Central.
   
   The certificate can only be generated based on the IP address, so it is essential to ensure that this IP remains consistent over time and does not vary across different networks.
2. Upload the Certificate: Access the Prism Central or Element interface and navigate to the SSL Certificate settings. Replace the default certificate by uploading your self-signed certificate.
3. Configure API Access: Update the settings to use the installed certificate for API communication, ensuring secure data exchange.
4. Verify the Setup: Test the connection and API access to confirm the certificate is correctly installed and functioning.

For more detailed guidance, you can explore resources like this article.