SecurityError: (:) [Connect-VIServer], ViSecurityNegotiationException(We canot connet the vcenter through powershell)

[ANANDA_M]

1. We installed Windows Server 2022 jumphost.

2. After that, we tried to connect through PowerShell our vcenter 

3. However, we encountered the following error:

 

 

Connect-VIServer : 10/2/2024 12:56:26 AM Connect-VIServer Error: Invalid server certificate. Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Prompt if you'd like to connect once or to add a permanent exception for this server.

Additional Information: Could not establish secure channel for SSL/TLS with authority 'rr.kc.local'.

At line:1 char:1

+ Connect-VIServer -Server rr.kc.local

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : SecurityError: (:) [Connect-VIServer], ViSecurityNegotiationException

    + FullyQualifiedErrorId : Client20_ConnectivityServiceImpl_Reconnect_CertificateError,VMware.VimAutomation.ViCore.Cmdlets.Commands.ConnectVIServer

 

 

4. I also tried the solution provided in this article, but the issue persists: [Broadcom Knowledge Base Article](https://knowledge.broadcom.com/external/article/374937/error-invalid-server-certificate-when-us.html).

[StephenMoll]

Connect-VIServer {Address} -Force

Deals with this issue I believe.

[ANANDA_M]

i have tried but no luck

[StephenMoll]

Ah! Clue might be in the error. What do you get if you do : (Get-PowerCLIConfiguration).InvalidCertificateAction ?

[ANANDA_M]

Same error 

[StephenMoll]

Running "(Get-PowerCLIConfiguration).InvalidCertificateAction" gives you the same error?

It shouldn't do. Its not trying to connect to anything. It should tell you the settings in your PowerCLI config for dealing with Invalid Certs.

As the first error says "Use Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Prompt".

Personally I use :

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore

So when I run "(Get-PowerCLIConfiguration).InvalidCertificateAction" I get back :

Ignore

Ignore

Ignore

First is for the scope "Session", the second for "User" and the third for "AllUsers".

Then I find the Connect-VIServer using the "Force" flag works.

[ANANDA_M]

Running "(Get-PowerCLIConfiguration).InvalidCertificateAction" gives you the same error? ans:-yes still giving same error

PS C:\windows\system32> Connect-VIServer -Server "vcenter server"

Connect-VIServer : 10/2/2024 11:11:54 PM Connect-VIServer Error: Invalid server certificate. Use 

Set-PowerCLIConfiguration to set the value for the InvalidCertificateAction option to Prompt if you'd like to connect 

once or to add a permanent exception for this server.

Additional Information: Could not establish secure channel for SSL/TLS with authority "vcenter server".

At line:1 char:1

+ Connect-VIServer -Server "vcenter server"

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : SecurityError: (:) [Connect-VIServer], ViSecurityNegotiationException

    + FullyQualifiedErrorId : Client20_ConnectivityServiceImpl_Reconnect_CertificateError,VMware.VimAutomation.ViCore.Cmd 

   lets.Commands.ConnectVIServer

[StephenMoll]

No you are running "Connect-VIServer" command. Try the commands as I have given them to you.

At the "PS C:\windows\system32>" prompt...

Type the following and press the enter key:

(Get-PowerCLIConfiguration).InvalidCertificateAction

My guess is this will return:

Fail

Fail

Fail

[ANANDA_M]

PS C:\windows\system32> (Get-PowerCLIConfiguration).InvalidCertificateAction

Ignore

Ignore

Ignore

 

PS C:\windows\system32> 

[StephenMoll]

That suggests that it should connect, because it is being told to ignore invalid certificates. 

Doesn't seem right.

I think I would be firstly trying a freshly started PowerShell or PowerShell-ISE session, as they sometimes get into a funny state in my experience, and restarting the session seems to help.

If that doesn't work I think I would be wondering if a reboot of VCSA and/or the client machine running the PowerShell sessions might be of help.

[ANANDA_M]

all point are covered means i tried only pending vcenter reboot pending let see hope it would be connect 

[StephenMoll]

Any luck?

[ANANDA_M]

Not yet but its connect on 2019 server also we are not reboted the vcenter any problem in 2022 server