Some CA NFA* Services or the CA Performance Center SSO service will not start with an error referencing a "Checksum Failed" error for Tanuki Software wrapper.

Products

CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

After a fresh install of NFA 9.1, the web GUI will not load at all.

Taking a look at the services everything is Started correctly except the following: "CA Performance Center SSO", "CA NFA RibSource", "CA NFA DNS/SNMP Proxies", and the "CA NFA Collection and Poller Webservices" services.

Within the directory \CA\NFA\Portal\SSO\ the 'Logs' folder is missing.

You can create the Logs folder in this directory and try to start the service again to generate a log file. In the wrapper.log you will see the error below:

 
DEBUG | wrapper | 2014/12/18 17:35:59 | Allocating a console for the servic e.

DEBUG | wrapper | 2014/12/18 17:35:59 | Found console window.

STATUS | wrapper | 2014/12/18 17:35:59 | --> Wrapper Started as Service

STATUS | wrapper | 2014/12/18 17:35:59 | Java Service Wrapper Standard Edition 32-bit 3.5.7

STATUS | wrapper | 2014/12/18 17:35:59 | Copyright (C) 1999-2010 Tanuki Software, Ltd. All Rights Reserved.

STATUS | wrapper | 2014/12/18 17:35:59 | http://wrapper.tanukisoftware.com

STATUS | wrapper | 2014/12/18 17:35:59 | Licensed to CA Technologies for Performance Center

STATUS | wrapper | 2014/12/18 17:35:59 |

FATAL | wrapper | 2014/12/18 17:35:59 | A signature was found in "D:\NFA\Portal\SSO\bin\PerfCenter-SSO.exe", but checksum failed: (Errorcode:0x47c320)wrapper.collect_sysinfo

FATAL | wrapper | 2014/12/18 17:35:59 | Signer Certificate: FATAL | wrapper | 2014/12/18 17:35:59 | Serial Number:

FATAL | wrapper | 2014/12/18 17:35:59 | 00 97 06 fe b5 6e 56 cc cb 66

Environment

Release: RAIB1H99000-9.3-Network Flow Analysis-Interface Bundle-Hardware
Component:

Cause

After a fresh install of NFA 9.1, the web GUI will not load at all.

Taking a look at the services everything is Started correctly except the following: "CA Performance Center SSO", "CA NFA RibSource", "CA NFA DNS/SNMP Proxies", and the "CA NFA Collection and Poller Webservices" services.

Within the directory \CA\NFA\Portal\SSO\ the 'Logs' folder is missing.

You can create the Logs folder in this directory and try to start the service again to generate a log file. In the wrapper.log you will see the error below:

 
DEBUG | wrapper | 2014/12/18 17:35:59 | Allocating a console for the servic e.

DEBUG | wrapper | 2014/12/18 17:35:59 | Found console window.

STATUS | wrapper | 2014/12/18 17:35:59 | --> Wrapper Started as Service

STATUS | wrapper | 2014/12/18 17:35:59 | Java Service Wrapper Standard Edition 32-bit 3.5.7

STATUS | wrapper | 2014/12/18 17:35:59 | Copyright (C) 1999-2010 Tanuki Software, Ltd. All Rights Reserved.

STATUS | wrapper | 2014/12/18 17:35:59 | http://wrapper.tanukisoftware.com

STATUS | wrapper | 2014/12/18 17:35:59 | Licensed to CA Technologies for Performance Center

STATUS | wrapper | 2014/12/18 17:35:59 |

FATAL | wrapper | 2014/12/18 17:35:59 | A signature was found in "D:\NFA\Portal\SSO\bin\PerfCenter-SSO.exe", but checksum failed: (Errorcode:0x47c320)wrapper.collect_sysinfo

FATAL | wrapper | 2014/12/18 17:35:59 | Signer Certificate: FATAL | wrapper | 2014/12/18 17:35:59 | Serial Number:

FATAL | wrapper | 2014/12/18 17:35:59 | 00 97 06 fe b5 6e 56 cc cb 66

Cause:

This is caused by the "UTN-USERFirst-Object Certificate" certificate not being installed into the "Trusted Root Certificate Authorities" which is needed by the Tanuki wrapper used by NFA for some services.

For more details see the link below. This usually occurs when the Local Security policy is too tight to allow the certificate to be installed properly.

http://wrapper.tanukisoftware.com/doc/english/troubleshooting.html#13

Resolution

Below are the steps to import missing certificate properly:

Download certificate from https://ftp.broadcom.com/user/downloads/pub/netqos/supporttools/releasedtools/TANUKI_WRAPPER_CERT_utn-userfirst-object.zip
Type 'mmc' into Start->Run
Navigate to File -> Add/Remove Snap-in...
Highlight 'Certificates' from 'Available snap-ins' and hit Add.
Select 'Computer account', Next, and then Finish

Expand 'Certificates (Local Computer)', then expand 'Trusted Root Certification Authorities'
- Check for the "UTN-USERFirst-Object" certificate in this folder, if not there proceed to step 7 to import the certificate
Right click on 'Certificates' -> All Tasks -> Import
Browse to the certificate that you downloaded in Step 1 and accept all the default settings all the way through.
Once you have successfully added the missing certificate, start the stopped services "CA Performance Center SSO", "CA NFA RibSource", "CA NFA DNS/SNMP Proxies" , and the "CA NFA Collection and Poller Webservices"
Verify that you should now be able to access the NFA web page.

**Note this can also occur with ohter NetQos products such as ADA and UCM**