6.0.3

Message Cause and solution
Unexpected status code: 404. SSO
Server failed during initialization
Restart vCenter Single Sign-On. If this does not correct the problem, see
the Recovery section of the vSphere Troubleshooting Guide.
The error shown in the UI begins
with Could not connect to
vCenter Single Sign-on.
You also see the return code SslHandshakeFailed. This is an uncommon
error. It indicates that the provided IP address or FQDN that resolves to
vCenter Single Sign-On host was not the one used when you installed
vCenter Single Sign-On.
In %TEMP%\VM_ssoreg.log, nd the line that contains the following
message.
host name in certificate did not match: <install-configured
FQDN or IP> != <A> or <B> or <C> where A was the FQDN you
entered during the vCenter Single Sign-On installation, and B and C are
system-generated allowable alternatives.
Correct the conguration to use the FQDN on the right of the != sign in the
log le. In most cases, use the FQDN that you specied during vCenter
Single Sign-On installation.
If none of the alternatives are possible in your network conguration,
recover your vCenter Single Sign-On SSL conguration.
Unable to Log In Using Active Directory Domain Authentication
You log in to a vCenter Server component from the vSphere Web Client. You use your Active Directory user
name and password. Authentication fails.
Problem
You add an Active Directory identity source to vCenter Single Sign-On, but users cannot log in to
vCenter Server.
Cause
Users use their user name and password to log in to the default domain. For all other domains, users must
include the domain name (user@domain or DOMAIN\user).
If you are using the vCenter Server Appliance, other problems might exist.
Solution
For all vCenter Single Sign-On deployments, you can change the default identity source. After that change,
users can log in to the default identity source with username and password only.
To congure your Integrated Windows Authentication identity source with a child domain within your
Active Directory forest, see VMware Knowledge Base article 2070433. By default, Integrated Windows
Authentication uses the root domain of your Active Directory forest.
If you are using the vCenter Server Appliance, and changing the default identity source does not resolve the
issue, perform the following additional troubleshooting steps.
1 Synchronize the clocks between the vCenter Server Appliance and the Active Directory domain
controllers.
2 Verify that each domain controller has a pointer record (PTR) in the Active Directory domain DNS
service and that the PTR record information matches the DNS name of the controller. When using the
vCenter Server Appliance, you can run the following commands to perform the task:
a To list the domain controllers run the following command:
# dig SRV _ldap._tcp.my-ad.com
The relevant addresses are in the answer section, as in the following example:
;; ANSWER SECTION:
_ldap._tcp.my-ad.com. (...) my-controller.my-ad.com
...
Chapter 2 vSphere Authentication with vCenter Single Sign-On
VMware, Inc. 61