During cluster join Self Signed Cert Generation fails because of fips flags in a freshly deployed Replica node
search cancel

During cluster join Self Signed Cert Generation fails because of fips flags in a freshly deployed Replica node

book

Article ID: 325897

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

Symptoms:
  • You are trying to join a vRA replica node to a vRA 7.x cluster
  • The operation fails


Environment

VMware vRealize Automation 7.x

Cause

fips flag causes the self-signed certificate generation to fail, stop the cluster join operation.

Resolution

VMware is aware of this issue.  See the Workaround section below for additional information.

Workaround:

Generate new Self Signed cert and update Key Store by removing the fips flags temporarily

Prerequisites

  • Please take simultaneous non-memory snapshots of each virtual appliance(s) in the cluster.
  • You have access to root user and password
  • You have SSH or console access to each virtual appliance.

Procedure

  1. SSH / PuTTy into the replica vRA virtual appliance failing to join
  2. To check the The Common Name in the self signed cert, it will be set to master node hostname, run 
    /usr/java/jre-vmware/bin/keytool -v -list -keystore /opt/vmware/horizon/workspace/conf/tcserver.keystore
  3. Create a backup directory 
    mkdir /root/tmp-bkp
  4. Move the fips flags 
    mv /usr/local/horizon/conf/flags/fips* /root/tmp-bkp
  5. Install Self Signed Cert and update the keystore 
    /usr/local/horizon/scripts/secure/wizardssl.hzn
  6. Move the files back 
    mv /root/tmp-bkp/fips* /usr/local/horizon/conf/flags
  7. Restart Horizon Workspace services 
    service horizon-workspace restart
  8. Retry the replica join operation


Powered by Wolken Software