Renewing SSL certificate in vCenter breaks Aria Operations SSO SAML authentication

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• SSO SAML authentication fails after renewing vCenter SSL certificates.
• Editing or creating a new SSO source results in the test connection succeeding, but saving the configuration fails with the following error:

Failed to setup SSO source, reason: Auth Exception occurred : 'Solution user detail' certificate is invalid - certificateException java.security.cert.CertificateExpiredException: NotAfter: Sat Apr 18 10:21:27 GMT 2020

• There are no expired certificates present in the UI.
• Applying KB Failed to setup SSO source, reason: Auth Exception occurred : 'Solution user detail' certificate is invalid - certificateException java.security.cert.CertificateExpiredException when trying to add vCenter to Aria Operations SSO auth temporally resolves the issue.
• Running the following command on all Aria Operations nodes (Primary, Replica, and Data) shows that one or more of the node(s) in the cluster has a expired certificate.
  

  openssl x509 -in /storage/vcops/user/conf/ssl/cluster_cert.pem -noout -enddate

Environment

VMware Aria Operations 8.18.x

Cause

SSO SAML authentication may fail in VMware Aria Operations after a vCenter certificate renewal. This issue typically presents with an "Auth Exception: 'Solution user detail' certificate is invalid" error, often due to Aria Operations retaining an expired internal certificate (cluster_cert.pem).

Resolution

1. Take snapshot of all Aria Operations nodes following KB Snapshot Creation in VMware Aria Operations
2. Take a back up of cluster_cert.pem file:

   mv /storage/vcops/user/conf/ssl/cluster_cert.pem /storage/vcops/user/conf/ssl/cluster_cert.pem.bkup

3. Take a backup of cluster_key.pem file : 

   mv /storage/vcops/user/conf/ssl/cluster_key.pem /storage/vcops/user/conf/ssl/cluster_key.pem.bkup

4. Copy and overwrite the cluster's active SSL certificate file with a CA certificate file: 

   cp -pf /storage/vcops/user/conf/ssl/cacert.pem /storage/vcops/user/conf/ssl/cluster_cert.pem

5. Copy the internal CA private key (cakey.pem) to overwrite the cluster's active SSL private key (cluster_key.pem):

   cp -pf /storage/vcops/user/conf/ssl/cakey.pem /storage/vcops/user/conf/ssl/cluster_key.pem

6. Restart Analytics Service: 

   systemctl restart analytics.service

7. Repeat step 2 to 6 on all analytics node in the cluster.
8. Confirm the certificate is no longer expired by running the following command : 

   openssl x509 -in /storage/vcops/user/conf/ssl/cluster_cert.pem -noout -enddate

9. Create new SSO auth source or edit the existing SSO configuration saving the changes.