ESXi IOFilter Storage Providers report expired certificates despite valid host certificates
search cancel

ESXi IOFilter Storage Providers report expired certificates despite valid host certificates

book

Article ID: 404744

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

ESXi IOFilter Storage Providers in the vSphere Client may report a certificate status of "Expired" or display a negative number of days remaining. This occurs even when the ESXi host machine certificates are valid and have been recently renewed. vCenter Server's Storage Policy Service (SPS) maintains a stale cache of previous certificate metadata which does not automatically update when host certificates are renewed. Standard rescan or synchronization tasks in the vSphere Client will not resolve this metadata mismatch.

  • The vSphere Client "Storage Providers" view shows IOFilter providers with an "Expired" status.

  • The certificate expiration date in vCenter reflects a past date, while the host XML version file (https://:9080/version.xml) shows a valid future date.

  • Alarms for "Certificate Status" are triggered for the vCenter Server.

Environment

  • vCenter 7.x
  • vCenter 8.x
  • vCenter 9.x

Cause

  • vCenter Server caches previous expired certificate metadata for IOFilter providers. The Storage Policy Service (SPS) does not automatically refresh this metadata upon host certificate renewal. A manual unregistration and re-registration of the provider is required to update the SMS database.

Resolution

  1. Retrieve the UID of all the IOFilter providers in the vCenter Server which needs to be re-registered.

    1. Login to vCenter Server using SSH Client.
    2. Restart the SPS service using the below commands:

      service-control --stop vmware-sps
      service-control --start vmware-sps

    3. After the service has successfully restarted, query the log file, /var/log/vmware/vmware-sps/sps.log file to retrieve the UID using the below command:
      • grep " Persisting CBP and storage associations for provider" /var/log/vmware/vmware-sps/sps.log | awk -F' ' '{ print $14" "$17 }' | sort | uniq -c

        For e.g:

      • grep " Persisting CBP and storage associations for provider" sps.log | awk -F' ' '{ print $14" "$17 }' | sort | uniq -c

        2 ########-####-####-####-########## https://<hostname##>:9080/version.xml 
        2 ########-####-####-####-########## https://<hostname##>:9080/version.xml
        2 ########-####-####-####-########## https://<hostname##>:9080/version.xml 
        2 ########-####-####-####-########## https://<hostname##>:9080/version.xml 

      • Query the log file using below command to retrieve the UID and hostname if above step is not helping to get Hostname and UID

      • grep "loading the provider with url" /var/log/vmware/vmware-sps/sps.log | awk '{print $13, " ", $17}' | sort | uniq

        For e.g.

      • grep "loading the provider with url" sps.log | awk '{print $13, " ", $17}' | sort | uniq

        https://<hostname##>:9080/version.xml  ########-####-####-####-########## 
        https://<hostname##>:9080/version.xml  ########-####-####-####-########## 
        https://<hostname##>:9080/version.xml  ########-####-####-####-##########
        https://<hostname##>:9080/version.xml  ########-####-####-####-##########

  2. Unregister the IOFilter provider in vCenter Server using the UID from Step 1

    1. Navigate to the vCenter SMS MOB interface: https://<vcenter-fqdn>/sms/mob
    2. Click on QueryStorageManager link.
    3. Click on Invoke method, then click on the "storageManager" link in the Method Invocation result.
    4. Click on UnregisterProvider_Task link
    5. Enter the UID of the provider identified through Step 1 above and select, Invoke Method.
    6. Restart the SPS service using the below commands

      service-control --stop vmware-sps
      service-control --start vmware-sps

Additional Information

Powered by Wolken Software