Error: Secure protocol communication error when configuring offline depot in VCF Installer.
search cancel

Error: Secure protocol communication error when configuring offline depot in VCF Installer.

book

Article ID: 403203

calendar_today

Updated On:

Products

VMware Cloud Foundation VMware SDDC Manager / VCF Installer

Issue/Introduction

  • Attempts to connect OFFLINE depot using 443 port ( SSL connection) fails with the following message:
    Secure protocol communication error, check logs for more details
  • The following log snippet is observed in the /var/log/vmware/vcf/lcm/lcm-debug.log :

    YYYY-MM_DDTHH:MM:SS.###+0000 INFO  [vcf_lcm,###############################,####] [o.a.h.c.h.i.c.HttpRequestRetryExec,http-nio-127.0.0.1-7400-exec-3] Recoverable I/O exception (###.###########.tls.TlsFatalAlert) caught when processing request to {s}->https://<ip_address>:<port>
    YYYY-MM_DDTHH:MM:SS.###+0000 ERROR [vcf_lcm,###############################,####] [c.v.e.s.l.b.d.depot.DepotDownloader,http-nio-127.0.0.1-7400-exec-3] Got TlsFatalAlert connecting to <ip_address>:<port>
    YYYY-MM_DDTHH:MM:SS.###+0000 ERROR [vcf_lcm,###############################,####] [c.v.v.l.r.a.c.v.s.DepotSettingsController,http-nio-127.0.0.1-7400-exec-3] Update Depot Settings
    com.vmware.evo.sddc.lcm.model.depot.exception.DepotConnectionFailureException: Secure protocol communication error, check logs for more details
            at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotDownloader.validateUser(DepotDownloader.java:506)
            at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotDownloader.validateUser(DepotDownloader.java:522)
            at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotBundleDownloadServiceImpl.validateUser(DepotBundleDownloadServiceImpl.java:271)
            at com.vmware.evo.sddc.lcm.services.impl.DepotUserCredentialServiceImpl.update(DepotUserCredentialServiceImpl.java:62)
            at com.vmware.evo.sddc.lcm.services.impl.DepotSettingsServiceImpl.updateDepotCredentials(DepotSettingsServiceImpl.java:131)
            at com.vmware.evo.sddc.lcm.services.impl.DepotSettingsServiceImpl.updateDepotSettings(DepotSettingsServiceImpl.java:89)
            at com.vmware.vcf.lcm.rest.api.controller.v1.settings.DepotSettingsController.updateDepotSettings(DepotSettingsController.java:88)
            at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
            at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)

Environment

VMware Cloud Foundation 9.x

Cause

The VCF Installer appliance does not trust the SSL/TLS certificate presented by the offline depot server. This occurs when the required Root or Intermediate Certificate Authority (CA) chain is missing from the appliance's Java trust store.

Resolution

To resolve the connection failure, import the depot server CA certificates into the VCF Installer trust store:

  1. Obtain the Base64-encoded (PEM) Root and Intermediate CA certificates from the offline depot server.
  2. Use SSH to log in to the VCF Installer appliance as the vcf user and elevate to root.
  3. Import the certificates using the steps detailed in the following KB : How to add/delete Custom CA Certificates to SDDC Manager and Common Services trust stores
  4. Restart the Life Cycle Management (LCM) service to refresh the trust store: systemctl restart lcm.service
  5. Retry the depot configuration in the VCF Installer GUI.

Additional Information

An "Idea" (Feature Request) is already posted in our Ideas portal for adding the ability to import custom CA TLS certificates using the VCF Installer UI.

Powered by Wolken Software