vRealize Automation 7.x users fail to login to tenant portal through API or client browser

Products

• VMware Aria Suite

Issue/Introduction

Provide debug log configuration to troubleshoot subjectAltName configuration assigned to embedded VMware Identity Manager.

Symptoms:

• vRealize Automation was installed with a CNAME alias
• Hostname within the virtual appliance management interface (VAMI) does not match the virtual IP hostname
• Connector.log will contain messages similar to:

javax.ws.rs.ProcessingException: javax.net.ssl.SSLHanshakeExeption: java.security.cert.CertificateException : No subject alternative DNS name matching <HOSTNAME> found

Environment

VMware vRealize Automation 7.x

Cause

Certificate configuration lacks subjectAltName attributes for each participating cluster member.

Resolution

Enable debug logging for Connector.log:

1. SSH into the vRealize Automation appliance
2. Edit the following file:

vi /usr/local/horizon/conf/saas-log4j.properties

3. Change the following line:

log4j.category.com.vmware.horizon=DEBUG

Apply a certificate that contains the FQDN of each participating cluster member within the subjectAltName attribute of the certificate configuration.

Example of a configuration file to generate a certificate with subjectAltNames is within the Related Information section below.
 

Additional Information

[req]

distinguished_name = req_distinguished_name

x509_extensions = v3_req

prompt = no

 

[req_distinguished_name]

C = US

ST = CO

L = Broomfield

O = VMware

OU = GSS

CN =  vRAApplianceVIP.domain.local

 

[v3_req]

keyUsage = keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth

subjectAltName = @alt_names

[alt_names]

DNS.1 = vRAApplianceNode1.domain.local

DNS.2 = vRAApplianceNode2.domain.local

DNS.3 = vRAApplianceVIP.domain.local