Automatic certificate renewal for non-admin tenant certificates deletes the certificate chain when certificate sharing is enabled

Products

• VMware Avi Load Balancer

Issue/Introduction

• Certificates in non-admin tenant lose their signing Intermediate/Root CA certificate references upon automatic renewal through a certificate management profile if the signing certificates are in the admin tenant and shared_ssl_certificates is enabled in the controller properties.

Environment

• Any deployment with shared_ssl_certificates enabled allowing non-admin leaf certificates to be linked to Intermediate/Root certificates in the admin tenant and having Certificate Management Profiles for automatic renewals.

Cause

• When we renew a certificate, we scan all of the certificates in the tenant, and then look to see if, as a result of this update, any of them get modified.
• In the same process, we look for the issuer certificate, and if the issuer isn’t present in the same tenant, we clear the field and set the name.
• In environments with shared_ssl_certificates, the issuer certificate is in the admin tenant, so this logic would incorrectly clear the reference links because it thinks the Intermediate/Root certificates no longer exist.

Resolution

• Bug ID: AV-203418
• Fix Versions: v22.1.7, v30.2.1+, v31.1.1
  
  • 22.1.7 release notes: https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/22-1/vmware-avi-load-balancer-release-notes/release-notes-22-1-7.html
  • 30.2.1 release notes: https://techdocs.broadcom.com/us/en/vmware-security-load-balancing/avi-load-balancer/avi-load-balancer/30-2/vmware-avi-load-balancer-release-notes/release-notes-for-avi-load-balancer-version-30-2-1.html
• Workarounds: 
  • Upload the CA/Intermediate certs in the tenants where they are required. This will automatically re-trigger chaining of the certs.
    OR
  • Perform a PUT on the affected App certificate with a copy of the same certificate string in the payload. This will re-trigger chaining.
    
    • Note: The above is just an example of the PUT body. The certificate body and other parameters may vary.