Error: "Connection error: could not negotiate SSL" when opening VMware Remote Console in Cloud Director
search cancel

Error: "Connection error: could not negotiate SSL" when opening VMware Remote Console in Cloud Director

book

Article ID: 342532

calendar_today

Updated On:

Products

VMware Cloud Director

Issue/Introduction

  • VMRC fails to connect, however, the Web Consoles may work just fine
  • This often occurs after a Cloud Director upgrade.
  • This can occur after replacing the certificate for Cloud Director.
  • The VMRC failures can be identified in the VMRC logs on the users local desktop. For location details see Location of Cloud Director VMRC client log files
In(05) main REMOTEMKS: expected thumbprint for remote display: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:AA
In(05) main SOCKET connect to wss://.example.com:443
In(05) main SOCKET webSocket's hostname: .example.com
In(05) main SOCKET creating new IPv4 socket, connecting to ###.###.###.###:443 (.example.com)
In(05) main PollSocketPairConnect: Blocking socket 1184 connected immediately!
In(05) main PollSocketPairConnect: Blocking socket 1196 connected immediately!
In(05) main MKSRoleMain: PowerOn finished.
In(05) mks MKSControlMgr: connected
In(05) mks MKS-VMDB: VMDB requested a screenshot
In(05) svga MKSScreenShotMgr: Taking a screenshot
In(05) mks KHBKL: Unable to parse keystring at: ''
In(05) mks KHBKL: Unable to parse keystring at: ''
Wa(03) mks SSL: Unknown SSL Error
In(05) mks SSL Error: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
Wa(03) mks SOCKET 2 (1164) Could not negotiate SSL
Wa(03)+ mks The remote host certificate has these problems:
Wa(03)+ mks
Wa(03)+ mks * self signed certificate in certificate chain
Wa(03) mks SOCKET 2 (1164) Expected thumbprint doesn't match actual thumbprint.
Wa(03) mks Expected thumbprint is: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:AA
Wa(03)+ mks Actual thumbprint is: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:BB
Wa(03) mks SOCKET 2 (1164) Cannot verify target host.
Wa(03) mks MVNCClient: received socket error 13: Connection error: could not negotiate SSL
In(05) mks MVNCClient: Setting vncClient.mksConnectionError, previous error is 0, new error is 1
In(05) mks MVNCClient: Destroying VNC Client socket.
In(05) mks MKSRoleMain: Disconnected from server (error=1)
In(05) mks MKS-RoleRemote: Disconnected from server with error code 1.
In(05) mks MKSThread: Requesting MKS exit

Environment

VMware Cloud Director 10.x

Cause

This issue occurs when the expected thumbprint for the VMRC console does not match the actual thumbprint presented.

The thumbprint mismatch can occur because the certificate in the Administration > Settings > Public Addresses tab is incomplete, out of order, or otherwise corrupt. The certificate imported to the Administration > Settings > Public Addresses tab must include the full chain as well as the correct endpoint certificate.

This issue can also occur if there is actually a different certificate chain altogether currently applied to the Administration > Settings > Public Addresses tab than what is applied to the load balancer.

Resolution

If the issue is because of something in a different order for the certificate chain, then the best way to resolve this issue is to validate the quality of the certificate chain, then import that chain via the built-in UI functionality to the Administration > Settings > Public Addresses tab. This can be done as follows:
  1. Review the /opt/vmware/vcloud-director/etc/global.properties file to identify the location of the HTTPS certificate. This path is referenced by the entry labeled "user.certificate.path". The default path is /opt/vmware/vcloud-director/etc/user.http.pem
  2. Copy the certificate from the path identified in step 1 to your workstation
  3. Navigate to the Provider portal and go to Administration > Settings > Public Addresses
  4. Click the "Edit" button at the top of page. Then proceed to click the "Replace Certificate File" button and upload the certificate from step 1
  5. Save this configuration for the Web Portal and API endpoint.
  6. Test VMRC again to see if the same issue occurs

If this is because there is a different certificate applied to the Administration > Settings > Public Addresses tab than what is applied to the load balancer:

  1. Locate the file that was used to apply the certificate to the load balancer.
  2. Navigate to the Provider portal and go to Administration > Settings > Public Addresses
  3. Click the "Edit" button at the top of page. Then proceed to click the "Replace Certificate File" button and upload the certificate from step 1
  4. Save this configuration for the Web Portal and API endpoint.
  5. Test VMRC again to see if the same issue occurs

Additional Information

This message indicates the thumbprint of the certificate which is currently set in the Administration > Settings > Public Addresses tab:
In(05) main REMOTEMKS: expected thumbprint for remote display: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:AA

This message indicates the actual certificate currently applied to the load balancer that the console is connecting to:
Wa(03)+ mks   Actual thumbprint is: ##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:BB

 

Powered by Wolken Software