During cluster join Self Signed Cert Generation fails because of fips flags in a freshly deployed Replica node
search cancel

During cluster join Self Signed Cert Generation fails because of fips flags in a freshly deployed Replica node

book

Article ID: 325897

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

Symptoms:
  • You are trying to join a vRA replica node to a vRA 7.x cluster
  • The operation fails


Environment

VMware vRealize Automation 7.x

Cause

fips flag causes the self-signed certificate generation to fail, stop the cluster join operation.

Resolution

VMware is aware of this issue.  See the Workaround section below for additional information.

Workaround:

Generate new Self Signed cert and update Key Store by removing the fips flags temporarily

Prerequisites

  • Please take simultaneous non-memory snapshots of each virtual appliance(s) in the cluster.
  • You have access to root user and password
  • You have SSH or console access to each virtual appliance.

Procedure

  1. SSH / PuTTy into the replica vRA virtual appliance failing to join
  2. To check the The Common Name in the self signed cert, it will be set to master node hostname, run
    /usr/java/jre-vmware/bin/keytool -v -list -keystore /opt/vmware/horizon/workspace/conf/tcserver.keystore
  3. Create a backup directory
    mkdir /root/tmp-bkp
  4. Move the fips flags
    mv /usr/local/horizon/conf/flags/fips* /root/tmp-bkp
  5. Install Self Signed Cert and update the keystore
    /usr/local/horizon/scripts/secure/wizardssl.hzn
  6. Move the files back
    mv /root/tmp-bkp/fips* /usr/local/horizon/conf/flags
  7. Restart Horizon Workspace services
    service horizon-workspace restart
  8. Retry the replica join operation