Aria Operations adapter certificate renewal and Expired Certificates banner cleanup

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Upon logging into the Product UI of Aria Operations, a banner is displayed across the top stating that there are expired certificates, pointing to Administration > Control Panel > Trusted Certificates section of the UI with the following possible text (Administration > Certificates in versions below 8.18.x):
  

  "Your certificate is expired. Please check the expiry date to take an action"

• Metric collection from a management pack may have stopped, and an adapter instance in Administration > Integrations may be in Warning Status.
  • Hovering the mouse pointer over the Warning Status shows a message similar to:
    

    Certificate validation has failed

• Automation Central calendar may fail to load, and logs may show Heartbeat Collector Errors 

ControllerInterface.getCollectorsHeartbeats failed : FunctionException: org.apache.geode.cache.execute.FunctionException: org.apache.geode.cache.execute.FunctionInvocationTargetException: MemberResponse got memberDeparted event for < 10.1.1.1(vRealize Ops Analytics-393cb76c-17d3-4c68-9e00-f61dc2633f76:127679)<ec><v3772>:10002 > crashed, true

• Expired certificates can cause stale metrics or vSphere adapter instances to show as down without explicit errors.
• Monitoring is down and certs superseded but showing as expired.

Environment

Aria Operations 8.x
vRealize Operations 8.x

Cause

The presence of this banner indicates that previously trusted certificates within Aria Operations have expired. This is expected behavior.

 

Resolution

Review article Certificate overview for VMware Aria Operations section Adapter and authentication sources for more information on endpoint certificates and potential caveats.

Quick links:

• Trusted endpoint certificates displayed in UI
• Import adapter endpoint certificate after endpoint certificate renewal
• Import authentication source certificate after authentication source certificate renewal

To resolve this issue:

1. Ensure you are logged in with an admin-level account.
2. Click the link in the banner, or navigate to Administration > Control Panel > Trusted Certificates (For Aria Operations versions below 8.18 navigate to Administration > Certificates).
3. Sort by the Expires column, and note which certificates are expired, as well as what endpoint they were issued to.
4. Make note of the certificate you are deleting. Is the certificate from a Management Pack or an Authentication Source?
5. Delete the expired certificate(s).

Important: If the following pop-up Confirmation with There are objects that trust this certificate : and prompting Delete certificate? window shows up when trying to delete the certificate, click No. Then proceed with the steps below.

If the certificate is from a Management Pack (Adapter instance):

1. Navigate to Administration > Integrations (Data Sources > Integrations in older versions).
2. Expand the Account instances until you find those correlated to the expired certificates identified in Step 3 above.
3. Click the ellipsis, then Edit, followed by Validate Connection.
4. Accept the new certificate if it is presented, and then click OK then Save.
5. Delete the expired certificate.

Note: If the above steps still do not delete the expired certificate, the workaround is to make note of the configurations of the accounts under the Management Pack(s). Then delete the accounts without deleting related objects. Then delete the expired certificate. Then add the accounts back to the Management Pack.

If the certificate is from an Authentication Source:

1. Navigate to Administration > Control Panel > Authentication Sources (Administration > Authentication Sources in older versions).
2. Click the ellipsis then Edit.
3. Click on Test.
4. Accept the new certificate if it is presented, and then click OK.

Additional Information

If you see message 'Cannot connect with the credentials due to an incorrect username or password' , follow KB article vCenter adapter integration failure in Aria Operations.

Translated article: Aria Operations でアダプタの証明書を更新する、または「期限切れの証明書」バナーをクリアする方法(431533)

If you see vIDM is retrieving invalid Certificate, https://knowledge.broadcom.com/external/article?articleNumber=436115

KB 394123 (vIDM Certificate replacement causes login failure in Aria Operations – "vIDM State is Disconnected" Error)