Vcenter with no TLS certificate

[tcooperma]

I am trying to use EKS anywhere with Vmware and Vcenter. I do not have a certificate and it is comeing up with the error:

Closer failed {"closerType": "*dependencies.Dependencies", "error": "govc returned error when logging out: govc: Post "https://10.0.0.9/sdk\": tls: failed to verify certificate: x509: certificate signed by unknown authority\n"}

How do I get it to ignore the certificate?

[tcooperma]

I figured it out.
apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: VSphereDatacenterConfig
metadata:
name: kn01
spec:
datacenter: "10.0.0.9"
insecure: true

[uldyssian-sh]

EKS Anywhere does not automatically ignore TLS verification for vCenter.
If your vCenter is using a self-signed or otherwise untrusted certificate, you must explicitly allow insecure connections in the VSphereDatacenterConfig.

To ignore the vCenter TLS certificate, set insecure: true in your vSphere datacenter configuration:

apiVersion: anywhere.eks.amazonaws.com/v1alpha1
kind: VSphereDatacenterConfig
metadata:
name: kn01
spec:
datacenter: "10.0.0.9"
insecure: true

This tells EKS Anywhere (and the underlying govc client) to skip certificate verification when connecting to vCenter.

Once this is set, cluster creation and management should proceed without TLS validation errors.

Important notes:

• This is intended for lab or non-production environments.
• For production, the recommended approach is to install a trusted TLS certificate on vCenter instead of disabling verification.
• Disabling TLS verification reduces protection against man-in-the-middle attacks.

Summary:

The error occurs because vCenter uses an untrusted certificate.
Set spec.insecure: true in VSphereDatacenterConfig to ignore TLS verification.
For production use, install a proper certificate rather than relying on insecure mode.

[uldyssian-sh]

Thanks! If this helps, please consider marking it as “Helpful” or “Accepted” 😊