Problem
You’ve noticed that VMware vCenter Site Recovery Manager Server service briefly starts and then stops:
The System event logs has the following error entry:
Log Name: System
Source: Service Control Manager
Event ID: 7034
Level: Error
The VMware vCenter Site Recovery Manager Server service terminated unexpectedly. It has done this 3 time(s).
Reviewing the SRM latest log in the folder:
C:ProgramDataVMwareVMware vCenter Site Recovery ManagerLogs
… reveals the following entry:
Section for VMware vCenter Site Recovery Manager, pid=5092, version=5.5.1, build=1647061, option=Release
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] Logging uses fast path: false
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] Handling bora/lib logs with VmaCore facilities
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] Initialized channel manager
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] Current working directory: C:Program FilesVMwareVMware vCenter Site Recovery Managerbin
2018-10-24T14:49:07.083+01:00 [03480 verbose ‘Default’] Setting COM threading model to MTA
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] ThreadPool windowsStackImmediateCommit = true
2018-10-24T14:49:07.083+01:00 [03480 info ‘ThreadPool’] Thread pool on asio: Min Io, Max Io, Min Task, Max Task, Max Concurency: 2, 401, 2, 200, 2147483647
2018-10-24T14:49:07.083+01:00 [03480 info ‘ThreadPool’] Thread enlisted
2018-10-24T14:49:07.083+01:00 [03480 info ‘Default’] Set dump dir to ‘C:ProgramDataVMwareVMware vCenter Site Recovery ManagerDumpFiles’
2018-10-24T14:49:07.083+01:00 [04204 info ‘ThreadPool’] Thread enlisted
2018-10-24T14:49:07.083+01:00 [04684 info ‘ThreadPool’] Thread enlisted
2018-10-24T14:49:07.083+01:00 [03652 info ‘ThreadPool’] Thread enlisted
2018-10-24T14:49:07.083+01:00 [00496 info ‘ThreadPool’] Thread enlisted
2018-10-24T14:49:07.177+01:00 [03480 info ‘Default’] Vmacore::InitSSL: handshakeTimeoutUs = 20000000
2018-10-24T14:49:07.239+01:00 [03480 error ‘Default’] Certificate has expired.
2018-10-24T14:49:07.270+01:00 [03480 verbose ‘HttpConnectionPool-000000’] HttpConnectionPoolImpl created. maxPoolConnections = 200; idleTimeout = 900000000; maxOpenConnections = 50; maxConnectionAge = 0
2018-10-24T14:49:07.317+01:00 [03652 verbose ‘Default’] Local and remote versions are the same. Talking with version vim.version.version9
2018-10-24T14:49:07.426+01:00 [03480 info ‘Default’] VC Connection: Logging in extension by subject name
2018-10-24T14:49:07.426+01:00 [03480 info ‘vmomi.soapStub[0]’] Resetting stub adapter for server <cs p:00000000041821b0, TCP:vcenter03.contoso.com:80> : Closed
2018-10-24T14:49:07.442+01:00 [03480 error ‘Default’] VC server does not trust our client certificate.
2018-10-24T14:49:07.520+01:00 [00496 info ‘ThreadPool’] Thread delisted
2018-10-24T14:49:07.520+01:00 [03652 info ‘ThreadPool’] Thread delisted
2018-10-24T14:49:07.520+01:00 [04684 info ‘ThreadPool’] Thread delisted
2018-10-24T14:49:07.520+01:00 [04204 info ‘ThreadPool’] Thread delisted
Solution
As indicated in the log file above, the certificate that SRM uses for communication with vCenter has expired. This can be confirmed by launching the certificate console and reviewing the properties of the certificate used by SRM.
To correct this issue, simply renew the certificate and update SRM to use the certificate by using the Change option in Programs and Features:
Select the Modify option:
You will need the service account you use to connect to the vCenter server:
The Automatically generate a certificate. option will generate a self-signed certificate. For this example, I have generated a certificate with an internal Enterprise CA so I’ll be selecting Use a PKCS#12 certificate file.:
**Note that the bottom indicates the Installed certificate status: Certificate has expired.
Proceed and enter the SRM database information in the wizard:
Select the Use existing database. option:
Continue by clicking Install to apply the changes:
——————————————————————————————————————————————————–
A few items worth mentioning for the certificate are:
- You can export a certificate as a PFX format the rename it to have the .p12 extension for importing it in the wizard.
- The requirements for the certificate may not be what you typically anticipate (e.g. you need the IP address in it for some reason) so refer to the following KB and carefully read the requirements (https://kb.vmware.com/s/article/2085644). The following are a few prompts that you may receive if the certificate being used does not meet the requirements:
Failed to validate certificate.
Details:
The certificate does not contain the SRM hots name. SRM server certificates must contain the SRM host name in the Subject Alternative Name field.
Failed to validate certificate.
Details:
The host name (somehostName.domain.com) in the Subject Alternative Name of the provided certificate does not identically match the SRM host name (10.31.30.12).
