Error: Secure protocol communication error when configuring offline depot in VCF Installer.

Products

• VMware Cloud Foundation
• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Attempts to connect OFFLINE depot using 443 port ( SSL connection) fails with the following message:
  Secure protocol communication error, check logs for more details

• The following log snippet is observed in the /var/log/vmware/vcf/lcm/lcm-debug.log :
  
  YYYY-MM_DDTHH:MM:SS.###+0000 INFO  [vcf_lcm,###############################,####] [o.a.h.c.h.i.c.HttpRequestRetryExec,http-nio-127.0.0.1-7400-exec-3] Recoverable I/O exception (###.###########.tls.TlsFatalAlert) caught when processing request to {s}->https://<ip_address>:<port>
YYYY-MM_DDTHH:MM:SS.###+0000 ERROR [vcf_lcm,###############################,####] [c.v.e.s.l.b.d.depot.DepotDownloader,http-nio-127.0.0.1-7400-exec-3] Got TlsFatalAlert connecting to <ip_address>:<port>
YYYY-MM_DDTHH:MM:SS.###+0000 ERROR [vcf_lcm,###############################,####] [c.v.v.l.r.a.c.v.s.DepotSettingsController,http-nio-127.0.0.1-7400-exec-3] Update Depot Settings
com.vmware.evo.sddc.lcm.model.depot.exception.DepotConnectionFailureException: Secure protocol communication error, check logs for more details
        at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotDownloader.validateUser(DepotDownloader.java:506)
        at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotDownloader.validateUser(DepotDownloader.java:522)
        at com.vmware.evo.sddc.lcm.bundle.download.depot.DepotBundleDownloadServiceImpl.validateUser(DepotBundleDownloadServiceImpl.java:271)
        at com.vmware.evo.sddc.lcm.services.impl.DepotUserCredentialServiceImpl.update(DepotUserCredentialServiceImpl.java:62)
        at com.vmware.evo.sddc.lcm.services.impl.DepotSettingsServiceImpl.updateDepotCredentials(DepotSettingsServiceImpl.java:131)
        at com.vmware.evo.sddc.lcm.services.impl.DepotSettingsServiceImpl.updateDepotSettings(DepotSettingsServiceImpl.java:89)
        at com.vmware.vcf.lcm.rest.api.controller.v1.settings.DepotSettingsController.updateDepotSettings(DepotSettingsController.java:88)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)

Environment

VMware Cloud Foundation 9.x

Cause

The environment is configured for unencrypted HTTP communication, which conflicts with the SDDC Manager/VCF Installer's default strict enforcement of HTTPS and required SSL/TLS certificate validation.

Resolution

1. Take a snapshot of the SDDC Manager/VCF Installer appliance.
2. Log in to SDDC Manager machine using vcf user and switch to root user using su
3. Create a backup of the application-prod.properties file :
   cp /opt/vmware/vcf/lcm/lcm-app/conf/application-prod.properties /opt/vmware/vcf/lcm/lcm-app/conf/application-prod.properties.bak
   
   
4. Edit the file /opt/vmware/vcf/lcm/lcm-app/conf/application-prod.properties using text editor like vi and set the value to false:
   Existing adapter configuration : lcm.depot.adapter.httpsEnabled=true
Updated adapter configuration : lcm.depot.adapter.httpsEnabled=false
   
   
5. Restart LCM service:
   systemctl restart lcm.service

Additional Information

To resolve the connection failure while using HTTPS protocol in the environment, import the depot server CA certificates into the VCF Installer trust store:

1. Obtain the Base64-encoded (PEM) Root and Intermediate CA certificates from the offline depot server.
2. Use SSH to log in to the VCF Installer appliance as the vcf user and elevate to root.
3. Import the certificates using the steps detailed in the following KB : How to add/delete Custom CA Certificates to SDDC Manager and Common Services trust stores
4. Restart the Life Cycle Management (LCM) service to refresh the trust store: systemctl restart lcm.service
5. Retry the depot configuration in the VCF Installer GUI.

The feature request has been added to enable the functionality to import custom CA TLS certificates using the VCF Installer UI, to track the request, refer : VCF Installer offline depot - TLS cert trust via GUI

To create feature requests, refer : Submitting enhancements requests for Broadcom products