Vmware Cloud Foundation: The certificate bundle upload validation fails with "Permitted subtrees cannot be built from name constraints extension"
Article ID: 313495
Updated On:
Products
Issue/Introduction
The certificate bundle upload validation fails with the following error ("Permitted subtrees cannot be built from name constraints extension") as noticed in the operations manager logs:
log file: /var/log/vmware/vcf/operatinsmanager.log
2023-02-27T09:05:40.246+0000 DEBUG [vcf_om,e1311c61666d4e43,d57e] [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-7300-exec-3] Processing localizable exception Permitted subtrees cannot be built from name constraints extension.
2023-02-27T09:05:40.247+0000 ERROR [vcf_om,e1311c61666d4e43,d57e] [c.v.e.s.e.h.LocalizableRuntimeExceptionHandler,http-nio-127.0.0.1-7300-exec-3] [UVD65N] CERTIFICATE_GENERAL_EXCEPTION Permitted subtrees cannot be built from name constraints extension.
com.vmware.vcf.certmgmt.rest.api.exception.CertMgmtRestException: Permitted subtrees cannot be built from name constraints extension.
at com.vmware.vcf.certmgmt.rest.api.controller.v1.CertificateManagementController.uploadCertificates(CertificateManagementController.java:691)
at com.vmware.vcf.certmgmt.rest.api.controller.v1.CertificateManagementController$$FastClassBySpringCGLIB$$641cd3ee.invoke(<generated>)
at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:218)
......
Caused by: java.lang.NullPointerException: null
at java.base/java.util.HashSet.<init>(HashSet.java:119)
at org.bouncycastle.asn1.x509.PKIXNameConstraintValidator.intersectOtherName(Unknown Source)
at org.bouncycastle.asn1.x509.PKIXNameConstraintValidator.intersectPermittedSubtree(Unknown Source)
Environment
VMware Cloud Foundation 4.0.x
VMware Cloud Foundation 2.x
Cause
If there is naming constraint field present in the certificates which are marked "<unsupported>" or "INVALID" the validation is expected to fail from VCF side.
To decode the certificate contents use the following command:
openssl x509 -in <certificate file>.crt -noout -text
In the extensions tab the decoded content should have a name constraints field. If there are any "unsupported" or "invalid" fields as shown the certificate will not be accepted by the SDDC manager.
X509v3 Name Constraints: critical
Permitted:
othername:<unsupported>
email:
DNS:<dns domain>
DNS:.<dns domain>
DirName:
URI:<dns name>
URI:.<dns domain>
IP:IP Address:<invalid>
Note: If using a certificate chain, check the above for all the intermediates.
Resolution
Currently there are no resolution to the issue.
Workaround:
To workaround the issue, please update the CA configuration, generate the certificate again avoiding these entries. Create the bundle to upload and replace certificates again.
Feedback
