Error "Failed to connect to the server: certificate_unknown(46)" during the initial Usage Meter connection or when attempting to send data to VCF Business Services console portal on existing deployment

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Unable to complete the initial Usage Meter configuration
  
  Error: Failed to connect to the proxy server: certificate_unknown
  
  
  
• Testing Cloud connectivity for existing Usage Meter fails with following error:
  
  The Cloud Connectivity page listed this error: "VCF Business Services console Test Failed due to "Upload failure for Notification stream. Authentication flow returned an error""
  "Failed to connect to the server: certificate_unknown(46)"

• In /opt/vmware/cloudusagemetering/var/logs/dss_main.log you see errors similar to the following: 

202#-##-## 14:04:38.085 ERROR --- [dss_hub_test_proxy_update] com.vmware.um.uploader.ProxyTester: Proxy test failed with IOException: certificate_unknown(46)
org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
    at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.checkServerTrusted(ProvSSLSocketWrap.java:131)
    at org.bouncycastle.jsse.provider.ProvTlsClient$1.notifyServerCertificate(ProvTlsClient.java:360)

Caused by: java.security.cert.CertificateException: Unable to construct a valid chain
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.validateChain(ProvX509TrustManager.java:313)
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkTrusted(ProvX509TrustManager.java:272)
    at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkServerTrusted(ProvX509TrustManager.java:181)
    at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.checkServerTrusted(ProvSSLSocketWrap.java:127)
    ... 43 common frames omitted
Caused by: java.security.cert.CertPathBuilderException: No issuer certificate for certificate in certification path found.
    at org.bouncycastle.jcajce.provider.PKIXCertPathBuilderSpi.engineBuild(Unknown Source)

Environment

VMware Usage Meter 4.x
VCF Usage Meter 9.x

 

Cause

Usage Meter cannot connect to the cloud portal because the proxy/firewall certificate is not imported or SSL connections are blocked by underlying network/firewall device

Resolution

1. To confirm the connection between the usage meter and the cloud portal, and to verify the certificate used for this connection, please execute the following command:
   
   curl -kv  https://eapi.broadcom.com/vcf/ums/api/v2/data/9.0
   
   
2. Import the firewall, load balancer, or proxy certificate based on your environment by following the "Import a Certificate to the vCloud Usage Meter Appliance Keystore" section.
3. Remove Usage Meter from SSL inspection from underlying network device/application

 

 

 

Additional Information

VMware Cloud Foundation Usage Meter is not uploading product usage data to VCF Business Services console