vCenter 7 update fails with error

Recently I wanted to update my VMware vSphere vCenter in my lab environment from vSphere 7 U1 to U3 latest release. Unfortunately each vCenter 7 update try fails with “install hook failed” error at 80 %. Since this troubleshooting and trial and error was very time consuming, I thought it was a good idea to share the solution. Hoping this post will save you the time.

Environment

The environment consists of a single vCenter Appliance (VCSA) running 7.0 Update 1.

Troubleshooting

Of course I searched the internet for a solution. But nothing removed the issue. Things I tried:

• Used an older version to update to. I tried to update to U2f. The result was the same. Only difference was that progress indicator ended at 92 or 93 %.
• As my vCenter appliance was quite short of resources, I added more vCPUs and memory to the VM. This helped at least to finish vCenter reboots and update attempts faster.
• Checked the STS certificate. An expired one can cause serious problems. Certificate was valid in my case.
• Running lsdoctor script. This was a great hope for me. It is a script to find possible issues in vCenter and PSC database. Fixing the issues is also possible with the use of the script.
  In my situation, lsdoctor criticized a certificate trust issue within the appliance. Fixing the findings did not solve the update problem.

Final solution

Last piece of the puzzle was a fling. It is called vSphere Diagnostic Tool.

“vSphere Diagnostic Tool is a python script that runs diagnostic commands on the vCenter Server Photon Appliance to return useful troubleshooting data while running within the confines of the local environment with out upstream dependencies.”

To be honest, I did not know this script until to this problem. I got a list of certificate thumbprint mismatches and a link to the KB that explains how to resolve these mismatches. Since the article is dealing with a completely different symptom, I would never have found it.

At the end, I am not 100 % sure if this was the only solution to the issue. I think that fixing problems that lsdoctor has addressed has also contributed to the success.

Notes

• When you plan to update vCenter, make sure to really backup it before! Do multiple backups! Best is to shut down VCSA and create a snapshot when VM is powered off. Additionally make sure, VAMI backup is current.
• Make also sure to have a reliable backup when you make changes to the VCSA during troubleshooting.
• Since certificates are always a hot topic, see my post on how to Replace machine certificate in vSphere 7