OpsMan upgrade fails with error "incorrect pkey type: rsaEncryption"

Products

• VMware Tanzu Kubernetes Grid Integrated Edition
• Operations Manager

Issue/Introduction

During the Import configuration step of Upgrading your Tanzu Operations Manager deployment, the following error shows up in the UI:

500 An error occurred

ActionView::Template::Error

incorrect pkey type: rsaEncryption

Environment

OpsMan 3.0.35 - 3.0.41

Cause

An incorrect cert/key pair for one or more OpsMan tiles is in use where the certificate and the key are signed using different algorithms, i.e. RSA and ECDSA.

Cert and key need to be signed using the same encryption algorithm. This is a general TLS/SSL requirement, not an OpsMan-specific one.

Resolution

Check all the cert/key pairs configured in all the OpsMan tiles and locate the offending ones where the certificate and the key are signed using different algorithms.

Generate new cert/key pairs signed with the same algorithm for the offending OpsMan tiles, then retry the upgrade.