After Aria Orchestrator/Aria Automation upgrade the UI is not reachable and the browser shows error ERR_SSL_KEY_USAGE_INCOMPATIBLE or ERR_CONNECTION_RESET

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article provides steps to recover the environment from the current broken state and to load the UI within the browser.

Opening Aria Orchestrator/Aria Automation UI after the upgrade, the browser shows the error ERR_SSL_KEY_USAGE_INCOMPATIBLE or ERR_CONNECTION_RESET

Environment

VMware Aria Automation 8.x

Cause

This issue can occur when upgrading to a newer version and the certificate being used was generated in a version of Aria Orchestrator/Aria Automation prior to 8.2 where the certificate formatting is different in earlier versions.

Resolution

Currently, there is no resolution.

To workaround the issue:

Note: In a clustered deployment, the steps below need to be run only on one of the nodes.

1. Open SSH session to already upgraded Aria Automation appliance and generate a new ingress certificate using below command:

vracli certificate ingress --generate auto --set stdin

2. Verify that the certificate is generated properly using below command

vracli certificate ingress --parse

Note: The output of the command above should contain the following fields:

"keyUsage": [

"DigitalSignature"

3. Apply the changes above by redeploying the services using command:

/opt/scripts/deploy.sh

4. Once the deploy script completes, check that the UI is reachable again.
   
   Note: In case you upgrade an external Aria Orchestrator that is registered as an integration of Aria Automation then you must accept the newly generated certificate. To do so, navigate to Aria Automation> Cloud Assembly > Infrastructure > Integrations and open the vRO integration. Click on validate button and accept the new certificate.