Problem
You have just successfully upgraded your VMware Horizon View 7.0.2 environment to 7.4.0 but noticed that the System Health of the View Composer Servers now displays a Red status with The service is not working properly and SSL as Unknown with no option of accepting the self signed certificate that the Composer service is using as you would normally expect to see.
The View 7.4.0 environment is currently using an older vSphere 5.5 environment and you have confirmed that TLS 1.0 has been enabled as per the following document:
Enable TLSv1.0 on vCenter and ESXi Connections from View Compose
Reviewing the event logs on the View Connection server show that the following error is logged:
Log Name: Application
Source: VMware
Event ID: 105
Level: Error
User: System
BROKER_SVI_CERT_INVALID
Certificate is invalid for Composer at address https://contosodrvc01.contoso.com:18443
Attributes:
Node=contosoUKVV01.contoso.com
ComposerId=https://contosodrvc01.contoso.com:18443
Severity=ERROR
Time=Fri Feb 02 22:01:58 GMT 2018
Module=Broker
Source=com.vmware.vdi.desktopcontroller.PublishVcCertToSviFederatedTask
Acknowledged=true
The Events in the View Administrator console display the following message:
Certificate is invalid for Composer at address https://<vcenter>.FQDN.com:18443
![clip_image002[5]](https://lh3.googleusercontent.com/-eEk6txedrL0/WnYQ3zoXOtI/AAAAAAACA6c/yKw1LgsypIc3yjg_F6IyWDJK6f-BrHliQCHMYCw/clip_image002%255B5%255D_thumb%255B1%255D?imgmax=800 "clip_image002[5]")
Attempting to view the properties of a linked-clone pool displays the following error:
The certificate configured on View Comopser Server is invalid, blocking communication with this server. To resume communication, replace the certificate with a valid certificate signed by a CA. Alternatively, accept the certificate thumbprint by clicking Verify in the View Administrator dashboard.
![clip_image002[7]](https://lh3.googleusercontent.com/-ZBUSaLDBmi8/WnYQ5wAxeKI/AAAAAAACA6k/Zdhmm_nZqosOrOj6gcMIc0-S0XyIPQB4gCHMYCw/clip_image002%255B7%255D_thumb%255B1%255D?imgmax=800 "clip_image002[7]")
You’ve confirmed that the correct self-signed certificate is assigned to the VMware Horizon View Composer service by executing the command:
sviconfig -operation=ReplaceCertificate -delete=false
![clip_image002[9]](https://lh3.googleusercontent.com/-HBx7X1VvGOE/WnYQ7mUv_lI/AAAAAAACA6s/E7l3UwxFfA8FK3VD_Fo16nZAoeTcGKF8QCHMYCw/clip_image002%255B9%255D_thumb?imgmax=800 "clip_image002[9]")
You’ve tried changing the pae-SVIURL to the short NetBIOS name instead of the FQDN:
![clip_image002[11]](https://lh3.googleusercontent.com/-yHwf4so63Bc/WnYQ9waW2TI/AAAAAAACA60/NT3BZDkG-7MJ7DJWn25sgIhDgxF9i7DaQCHMYCw/clip_image002%255B11%255D_thumb%255B1%255D?imgmax=800 "clip_image002[11]")
Solution
If you do not include on issuing a certificate from a trusted Certificate Authority and would like to use the self-signed certificate, the way to accept it is to navigate to the View Configuration > Servers menu, select the vCenter instance then click Edit to bring up the vCenter Server settings, then click Edit under the View Composer Server Settings section:
Getting into the configuration settings of the View Composer will now display the following invalid certificate detected prompt:
![clip_image002[13]](https://lh3.googleusercontent.com/-U-WAja-z5Ck/WnYRB2RaSQI/AAAAAAACA7E/I3MgSreW9p09ogVaRnSzq1nSnhnAjhIBgCHMYCw/clip_image002%255B13%255D_thumb%255B1%255D?imgmax=800 "clip_image002[13]")
Click on the View Certificate… button will display the option to accept the self-signed certificate:
![clip_image002[15]](https://lh3.googleusercontent.com/-9LdBWFBWE14/WnYRD66zRaI/AAAAAAACA7M/31dwnm3tjjAPcUla7frdiMsZpRSVrscFQCHMYCw/clip_image002%255B15%255D_thumb%255B1%255D?imgmax=800 "clip_image002[15]")
Accepting the certificate should now display the View Composer Servers health as green:
![clip_image002[17]](https://lh3.googleusercontent.com/-jzq9JO_d9ic/WnYRGJpvEEI/AAAAAAACA7U/zbb0YEDe2TovlWOAlJygkYovr9s7H2n6wCHMYCw/clip_image002%255B17%255D_thumb%255B1%255D?imgmax=800 "clip_image002[17]")
3 Responses
Hey, thank you for your blog! It has saved me a lot of time!
We're running Horizon View 7.0.2 and we want to upgrade yo 7.4 (or 7.5). We've "played" a lot with it in our lab environment and no problems. But a friend of mine has told me we have to upgrade first to version 7.2 and then to 7.4 (or 7.5) because, if not, some configurations might be lost…. do you know if it's true? Do you have a post explainig the upgrade processs?
Thank you very much!
Hi Santiago, I Will do this upgrade tomorrow, and I tell you my experience.
Hey Terence!
Recently, we suffered a catastrophic vSAN loss due to some guys messing around in the data center. We lost a lot of data and had to rebuild some things. vCenter being one of them. Our DCs were down at the time and so I created a new vCenter (new IP and all) with the IP address as the name (vCenter provisioning would fail if I tried using a DNS name because it couldn't be queried). Anyhoo – got everything back up and running and pointed our Horizon View environment to the new vCenter. Had to delete all the existing VDI pools and rebuild them, all was good. UNTIL – I finally removed the old vCenter object from Horizon under servers. The server wasn't even alive anymore, it had been gone for weeks. But it messed something up with certificates and now we have a slew of certificate errors. Primarily "horizon view message:validatecertificatechain result:FAIL endentityreasons: namemismatch" and "virtualcenterdriver unable to connect to view composer server", etc. So I cleaned up all of the stale vCenter entries in view composer Database, also from ADSI edit, and everything looked ok. I updated the server name in the virtual center object properties from ADSI edit and changed it from the IP address to the FQDN. Made sure the SSL thumbprints were added for vCenter and View Composer (the fields were empty), lots of reboots in the correct boot order, and also verified in sviconfig that the certificate fqdn matches in the pae-SVIURL attribute value (+18443). The external URL for vCenter is still the IP (I don't think I can change this), but I have a DNS record that resolves the IP to the name. Not really sure what else to do. All of my VMs can be accessed/logged into by our users, but I can't manage anything. Screen is blank in Horizon when I select a pool and tons of errors in the Horizon logs mentioning certificate mismatch issues. Any direction you can provide would be super amazing. Our vCenter support agreement ended nearly 4 years ago, so I'm winging it the best I can. Thanks SO much!