Unable to delete certificate thumbprint from UI in VMware Aria Operations (Formerly vRealize Operations Manager)

Products

• VMware Aria Suite
• VMware Aria Operations 8.x
• VMware Aria Operations (formerly vRealize Operations) 8.x

Issue/Introduction

Symptoms:

• In vRealize Operations Manager UI, deleting a Certificate from Trusted Certificates fails with error:

Internal Error Occurred

• Unable to log in to vRealize Operations Manager UI after accepting a new certificate.
• In the /storage/vcops/log/web*.log file, you see entries similar:

INFO [ajp-bio-127.0.0.1-8009-exec-15] com.vmware.vcops.ui.util.MainPortalListener.log - (
Component: TODO
Url: /ui/certificate.action
Params: mainAction=deleteCertificate
)
java.lang.NullPointerException
at com.vmware.vcops.bridge.model.CertificateTrustObjectParam.getURIRepresentation(CertificateTrustObjectParam.java:45)
at com.vmware.vcops.bridge.model.CertificateTrustObjectParam.getURIRepresentation(CertificateTrustObjectParam.java:52)
at com.vmware.vcops.ui.action.CertificateAction.getTrustObjectDisplayName(CertificateAction.java:81)
at com.vmware.vcops.ui.action.CertificateAction.execute(CertificateAction.java:53)

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware Aria Operations 8.12 and Later

Resolution

To resolve the issue, Kindly refer to the steps below to manually delete the certificates from the database.

For vRealize Operations v8.0 to v8.6.4

For vRealize Operations 8.10, Aria Operations 8.12 and later

⚠️  **Warning:** Before proceeding, take snapshots of all nodes to avoid data loss.

vRealize Operations v8.0 - v8.6.4

1. Log in to vRealize Operations Manager master node as root through SSH or Console.
   
   
2. Run this command to log in to the database:
   # $VMWARE_PYTHON_BIN $ALIVE_BASE/cassandra/apache-cassandra-*/bin/cqlsh --ssl --cqlshrc $ALIVE_BASE/user/conf/cassandra/cqlshrc
   
   
3. Run this command to get a list of all certificates in the database:
   # select key from globalpersistence.certificate;
   
   Note: You see the output similar to:
   
   key
------------------------------------------------------
Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
   
   
4. Note the key of the certificate you want to delete, where the thumbprint of the certificate is the key.
   
   
5. Run this command to delete the certificate:
   # delete from globalpersistence.certificate where namespace='certificate' and classtype='certificate' and key='Certificate.thumbprint';
   
   Examples:
   Note: Replace Certificate.thumbprint with the key noted in step 4.
   # delete from globalpersistence.certificate where namespace='certificate' and classtype='certificate' and key='Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
   
   
6. Run this command to exit the database:
   # quit;

 

vRealize Operations 8.10, Aria Operations 8.12 and later

1. Log in to vRealize Operations Manager master node as root through SSH or Console.
   
   
2. Run this command to log in to the database:
   # su - postgres -c "/opt/vmware/vpostgres/current/bin/psql -d vcopsdb -p 5433"
   
   
3. Run this command to get a list of all certificates in the database:
   # select key from kv_certificate;
   
   Note: You see the output similar to:
   
   key
------------------------------------------------------
Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
   
   
4. Note the key of the certificate you want to delete, where the thumbprint of the certificate is the key.
   
   
5. Run this command to delete the certificate:
   # delete from kv_certificate where key = 'Certificate.thumbprint';
   
   Examples: 
   
   Note: Replace Certificate.thumbprint with the key noted in step 4.
   # delete from kv_certificate where key = 'Certificate.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
   
   
6. Run this command to exit the database:
   # \q

Additional Information

Customer could be asking to remove the certificate but adapter no longer existed in the environment. In that situation, certificate cannot be removed from the UI but showing the expired certificate banner in the page.  Deleting directly from the database is another option. After removing the records from the database refreshing the UI should no longer showing the expired certificate.