Symptoms:
This is not a bug and NSX-T is working as expected.
Workaround:
The following needs to be done whenever certificates are changed on the controller with a non well known CA:
When attempting to import a certificate into the cacerts
keystore, if you encounter the following error:
keytool error: java.lang.Exception: Certificate not imported, alias <startssl> already exists
This error occurs because a certificate with the alias <startssl> already exists in the cacerts keystore. Since each alias must be unique within the keystore,
you cannot import a new certificate using an existing alias.
Verification
To check whether the alias already exists in the cacerts keystore, use the following keytool commands:
-List all certificates and search for the alias:
keytool -list -v -keystore /usr/java/jre/lib/security/cacerts -storepass changeit | grep -i alias
-Check details of a specific alias:
keytool -list -v -keystore /usr/java/jre/lib/security/cacerts -alias startssl
Resolution
To resolve this error, you should use a different alias when importing the certificate. Follow these steps:
1.Backup the existing cacerts
keystore:
cd /usr/java/jre/lib/security/
cp -p cacerts cacerts_backup
2.Import the certificate with a new alias:
keytool -importcert -alias startssl1 -keystore /usr/java/jre/lib/security/cacerts -storepass changeit -file <ca-file-path>
Replace <ca-file-path>
with the path to your certificate file.
Note
The alias is a unique identifier for each certificate within the keystore. Using a different alias ensures that there are no conflicts and allows the new certificate
to be imported successfully.