vROPs 8.x upgrade fails: "Signature on PAK file is not valid"

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:
At the time of failure, the following will be present:

• The VMware Aria Operations Admin UI will display a message similar to:

Signature on PAK file 'vRealize_Operations_Manager-VA-8.x-to-8.2.0.18707701.pak' is not valid.

Note: Your PAK file name may differ.

• The /storage/log/vcops/log/casa/casa.log file shows entries similar to:

2022-01-28T13:06:48,349+0000  INFO [ajp-nio-127.0.0.1-8011-exec-86] [AP003Akt] support.subprocess.GeneralCommand:255 - Command '/usr/bin/sudo -n /usr/lib/vmware-python-3/bin/python /usr/lib/vmware-vcopssuite/utilities/pakManager/bin/vcopsPakManager.py --action query_pak_signature --pak /storage/db/casa/pak/dist_pak_files/cargo/reservedTemp_8158315163481856854.pak --json' threw exception: CommandLine ExitException: key=general.failure; args=1,; cause=

• The /storage/log/vcops/log/pakManager/vcopsPakManager.root.query.log file shows entries similar to:

2022-01-28T13:31:01 INFO [20752] - vcopsPakSignatureValidation.getExpectedCertificates:335 - Unable to retrieve Software Publishing Certificate with alias vmwarespc from truststore /storage/vcops/user/conf/ssl/tcserver.truststore.

Environment

VMware vRealize Operations 8.4.x
VMware vRealize Operations 8.10.x
VMware vRealize Operations 8.0.x
VMware vRealize Operations 8.3.x
VMware vRealize Operations 8.5.x
VMware vRealize Operations 8.6.x
VMware vRealize Operations 8.2.x
VMware vRealize Operations 8.1.x

Cause

This issue is caused by a vmwarespc certificate missing from the truststore of VMware Aria Operations (formerly known as VMware Aria Operations).

Resolution

To resolve this issue, install the missing vmwarespc certificate in the truststore.

1. Log into the Primary node as root via SSH or Console, pressing ALT+F1 in a Console to log in.
2. Run the following command to install the vmwarespc certificate in the truststore:

/usr/java/latest/bin/keytool -importcert -trustcacerts -alias vmwarespc -file /usr/lib/vmware-vcopssuite/utilities/conf/vmwarespc.pem -keystore /storage/vcops/user/conf/ssl/tcserver.truststore -storepass "$(sed -n 's/^ssltruststorePassword=//p' /data/vcops/user/conf/ssl/storePass.properties)" -noprompt

Re-attempt the upgrade in the VMware Aria Operations Admin UI.