Error "keystore was tampered with or password was incorrect" in Aria Operations for logs

Products

• VMware Aria Suite

Issue/Introduction

After updating the certificates, one node's truststore certificate wasn't updated, unlike the other nodes.

Running the command "nodetool -no-pass status" resulted in an error indicating that Cassandra is not running.

Environment

VMware Aria Operations for Logs 8.18.x

Cause

Certificate fingerprint mismatch in the Truststore or Keystore.

Resolution

To resolve the issue, validate the fingerprints in the Truststore and the Keystore on all the nodes using the commands below.

1. Log into the problematic node and other nodes as root via SSH or Console.
2. Stop the loginsight service:
   

   service loginsight stop

3. List the Keystore certificates on all the nodes: 
   

   keytool -list -keystore /usr/lib/loginsight/application/etc/3rd_config/keystore (Password is not required, press enter)

4. List the Truststore certificates on all the nodes: 
   

   keytool -list -keystore /usr/lib/loginsight/application/etc/truststore (Password is not required, press enter)

5. Check the SSL certificate in the Keystore and find the "Alias name: loginsight" in the certificate chain, which contains certificate fingerprints SHA1, SHA256, Verify that the fingerprints are identical across all nodes. 
6. Check the root certificate in the Truststore, verify that the fingerprints are identical across all nodes. 
7. If found the discrepancy then winscp to the problematic node and the working node to copy the truststore or Keystore to the problematic node.
   For Truststore navigate to the location: 
   

   /usr/lib/loginsight/application/etc/truststore

   
   For keystore navigate to the location:
   

    /usr/lib/loginsight/application/etc/3rd_config/keystore

8. systemctl restart loginsight

Additional Information

 NOTE - Retrieve the keystore password by running following command.

grep keystore-password /storage/core/loginsight/config/loginsight-config.xml*