If Horizon says \u201eUnable to establish a connection to the vCenter Server\u201c right after you renewed the vCenter certificate, and it never asks you to accept the new one, the Connection Server is still pinned to the old certificate. Here’s the fix, with a real example: vCenter 7.0.3 with VMCA certificates and Omnissa Horizon 8 (Connection Server 8.18).<\/em><\/p>\n The vCenter Machine SSL certificate issued by VMCA is valid for 2 years. When it expires, or when you renew it, Horizon can’t talk to vCenter anymore. Users can still log in to desktops that are already running, but provisioning and power operations stop. With instant clones every logoff ends with Resync operation failed<\/strong>, and the pool slowly drains.<\/p>\n Normally you just edit the vCenter in Horizon Console and accept the new certificate. In my case the accept dialog never showed up.<\/p>\n In vSphere Client go to Administration \u2192 Certificates \u2192 Certificate Management \u2192 Machine SSL Certificate \u2192 Actions \u2192 Renew and keep 730 days. vCenter restarts its services, which takes about 10\u201315 minutes.<\/p>\n Heads up:<\/strong> check the STS signing and solution user certificates too. If STS expires, nobody can log in to vCenter at all, and Renew on Machine SSL won’t fix that.<\/p>\n Check the new certificate on the VCSA:<\/p>\n Write down the SHA-1 fingerprint, you’ll need it in Step 5.<\/p>\n In Horizon Console go to Settings \u2192 Servers \u2192 vCenter Servers, select the vCenter, click Edit and then OK. Normally an \u201eInvalid Certificate Detected\u201c dialog appears, and you click Accept. Done.<\/p>\n In my case it didn’t. I only got \u201eUnable to establish a connection to the vCenter Server\u201c, and after a Connection Server service restart the whole vCenter Servers tab failed with \u201eAn internal server error occurred\u201c.<\/p>\n Watch out:<\/strong> on Omnissa builds the logs are no longer in The log made it clear:<\/p>\n The Connection Server doesn’t trust the VMCA root, so it compares the certificate with the copy it has stored. They don’t match, and the TLS handshake fails before the console ever gets to the accept dialog.<\/p>\n Horizon keeps the trusted vCenter certificate in its ADAM database ( This was the surprise: The script backs up the old value to the desktop and pulls the certificate from vCenter. It writes it only if the SHA-1 matches the one from Step 1:<\/p>\n Heads up:<\/strong> Windows PowerShell 5 tries TLS 1.0 by default and fails with \u201eA call to SSPI failed\u201c, because vCenter 7 only allows TLS 1.2. That’s why Restart the Connection Server service and wait 2\u20133 minutes. The vCenter Servers tab loads again and System Health turns green.<\/p>\n Careful:<\/strong> with Secure Tunnel enabled, the restart drops every active session. With a single Connection Server, do it after hours.<\/p>\n Machines stuck in Problem Machines (for me an instant clone with Resync operation failed<\/strong>) go to Inventory \u2192 Machines \u2192 More Commands \u2192 Recover. If that doesn’t help, Remove them and the pool rebuilds them.<\/p>\n Still no accept dialog in Horizon?<\/strong> That’s expected here. The dialog only appears when the connection gets as far as the certificate check. With a mismatched thumbprint it fails earlier.<\/p>\n Can’t find Want to avoid this next time?<\/strong> Import the VMCA root into Local Computer \u2192 Trusted Root Certification Authorities<\/em> on every Connection Server. Download it from the vCenter landing page \u2192 Download trusted root CA certificates, \u00a0<\/p>\n","protected":false},"excerpt":{"rendered":" Horizon can’t connect to vCenter after a certificate renewal? Fix the stored certificate in ADAM If Horizon says \u201eUnable to establish a connection to the vCenter Server\u201c right after you …<\/p>\n","protected":false},"author":2,"featured_media":6579,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[204,225],"tags":[433,80,310,100],"yoast_head":"\nWhy bother?<\/h2>\n
What you’ll need<\/h2>\n
\n
Step 1: Renew the Machine SSL certificate<\/h3>\n
openssl x509 -in <(\/usr\/lib\/vmware-vmafd\/bin\/vecs-cli entry getcert --store MACHINE_SSL_CERT --alias __MACHINE_CERT) -noout -fingerprint -sha1 -enddate<\/code><\/pre>\nStep 2: Try to accept the certificate in Horizon<\/h3>\n
Step 3: Find the real error in the Connection Server log<\/h3>\n
C:\\ProgramData\\VMware\\VDM\\logs<\/code>. The old folder may still be there after an upgrade, but nothing new gets written to it. The current path is C:\\ProgramData\\Omnissa\\Horizon\\logs<\/code>.<\/p>\n$log = (Get-ChildItem C:\\ProgramData\\Omnissa\\Horizon\\logs\\debug-*.txt | Sort-Object LastWriteTime -Descending | Select-Object -First 1).FullName\nGet-Content $log -Tail 5000 | Select-String \"thumbprint|VirtualCenter|Exception\" | Select-Object -Last 30 | ForEach-Object { $_.Line }<\/code><\/pre>\n[CertMatchingTrustManager] invalid certificate (doesn't match trusted thumbprint) for vcsa.example.local:443\nCaused by: com.omnissa.vdi.ssl.MismatchedThumbprintException: InvalidCertificateException[reasons:notTrusted;cantCheckRevoked;chainReasons:partialChain, noTrust]<\/code><\/pre>\nStep 4: Find the vCenter object in ADAM<\/h3>\n
DC=vdi,DC=vmware,DC=int<\/code>). The GUID of the vCenter object is in the log (VirtualCenterDriver-<GUID><\/code>). OU=Properties<\/code> has thousands of objects, so PowerShell is faster than clicking through ADSI Edit:<\/p>\n$r=[ADSI]\"LDAP:\/\/localhost:389\/DC=vdi,DC=vmware,DC=int\"\n$o=(New-Object DirectoryServices.DirectorySearcher($r,\"(cn=<GUID>)\")).FindOne(); $o.Path\n$o.Properties.PropertyNames | ? { $_ -match 'thumb|url|cert' } | % { \"$_ = $($o.Properties[$_])\" }<\/code><\/pre>\npae-VCSSLCertThumbprint<\/code> doesn’t hold a hash. With pae-VCSSLCertThumbprintAlgorithm = DER_BASE64_PEM<\/code> it holds the whole old certificate in PEM.<\/p>\nStep 5: Write the new certificate<\/h3>\n
$e=[ADSI]\"LDAP:\/\/localhost:389\/CN=<GUID>,OU=VirtualCenter,OU=Properties,DC=vdi,DC=vmware,DC=int\"\n$old=[string]$e.Properties['pae-VCSSLCertThumbprint'].Value\n$old | Out-File \"$env:USERPROFILE\\Desktop\\vc-cert-backup.txt\"\n$nl= if($old -match \"`r`n\"){\"`r`n\"}else{\"`n\"}; $end= if($old.EndsWith(\"`n\")){$nl}else{\"\"}\n\n$h='vcsa.example.local'; $t=New-Object Net.Sockets.TcpClient($h,443)\n$s=New-Object Net.Security.SslStream($t.GetStream(),$false,{$true})\n$s.AuthenticateAsClient($h,$null,[Security.Authentication.SslProtocols]::Tls12,$false)\n$c=New-Object Security.Cryptography.X509Certificates.X509Certificate2($s.RemoteCertificate); $t.Close()\nif($c.Thumbprint -ne '<SHA1_WITHOUT_COLONS>'){ throw \"Thumbprint mismatch\" }\n\n$b64=([Convert]::ToBase64String($c.RawData) -replace '(.{64})',\"`$1$nl\").TrimEnd()\n$e.Put('pae-VCSSLCertThumbprint',\"-----BEGIN CERTIFICATE-----$nl$b64$nl-----END CERTIFICATE-----$end\"); $e.SetInfo()<\/code><\/pre>\nTls12<\/code> is set explicitly.<\/p>\nStep 6: Restart the Connection Server service and clean up<\/h3>\n
Common issues<\/h2>\n
debug.txt<\/code>?<\/strong> It doesn’t exist. The current log is the newest debug-<date>.txt<\/code> in C:\\ProgramData\\Omnissa\\Horizon\\logs<\/code>.<\/p>\ncerts\\win<\/code> folder. Also hook the vCenter certificate expiration alarm to email, so the next renewal isn’t a last-minute job.<\/p>\n