Health Check operations in SDDC Manager fails at Ntp-check Perform validation checks on SDDC components during NTP check for VMware Aria products
search cancel

Health Check operations in SDDC Manager fails at Ntp-check Perform validation checks on SDDC components during NTP check for VMware Aria products

book

Article ID: 406025

calendar_today

Updated On:

Products

VMware SDDC Manager / VCF Installer

Issue/Introduction

When running a vcf-sos health check in VMware Cloud Foundation (VCF), the NTP check for VMware Aria Suite Lifecycle (formerly vRealize Suite Lifecycle Manager) or NSX components fails on Certificate validation. This error indicates an underlying SSL trust failure between SDDC Manager and the Aria Suite Lifecycle appliance.

Symptoms:

  • The SOS health check report shows FAILED or RED for Aria Suite Lifecycle or NSX NTP status.
  • The  vcf-sos.log log file shows:

      • ...
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'vrslcm.example.com' (_ssl.c:1007)
...
      • Unknown Exception occurred during NTP check for VMware Aria products: vrslcm_FQDN, please refer sos.log for more details or contact support.Error : AttributeError("\'NoneType\' object has no attribute \'text\'")
        YYYY-MM-DDTHH:MM:SS.602+0000 INFO [vcf_sos] [db_api.py::fetch_a_record::264::check_sddcmanager_ntpThread0] Fetching records for table <class 'framework.dbinterface.database.Tasks'> with id in ['1e003064-732
e-478c-88a8-45375350a7da']
YYYY-MM-DDTHH:MM:SS:03.603+0000 ERROR [vcf_sos] [restutil.py::get::180::_parallel_check_vrslcm_ntp_configuredThread0] Traceback (most recent call last):
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/connectionpool.py", line 715, in urlopen
    httplib_response = self._make_request(
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/connectionpool.py", line 404, in _make_request
    self._validate_conn(conn)
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/connectionpool.py", line 1058, in _validate_conn
    conn.connect()
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/connection.py", line 419, in connect
    self.sock = ssl_wrap_socket(
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
    ssl_sock = _ssl_wrap_socket_impl(
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
    return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1100, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1371, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unsuitable certificate purpose (_ssl.c:1007)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/adapters.py", line 667, in send resp = conn.urlopen(
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/connectionpool.py", line 799, in urlopen retries = retries.increment(
  File "/opt/vmware/sddc-support/services/../framework/../dependency/urllib3/util/retry.py", line 592, in increment raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='vrslcm.example.com', port=443): Max retries exceeded with url: /lcm/lcops/api/v2/settings/system-details/time (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unsuitable certificate purpose (_ssl.c:1007)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "utils/restutil.py", line 165, in get
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/api.py", line 73, in get return request("get", url, params=params, **kwargs)
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/api.py", line 59, in request return session.request(method=method, url=url, **kwargs)
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/sessions.py", line 589, in request resp = self.send(prep, **send_kwargs)
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/sessions.py", line 703, in send r = adapter.send(request, **kwargs)
  File "/opt/vmware/sddc-support/services/../framework/../dependency/requests/adapters.py", line 698, in send raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='vrslcm.example.com', port=443): Max retries exceeded with url: /lcm/lcops/api/v2/settings/system-details/time (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unsuitable certificate purpose (_ssl.c:1007)')))
  • /opt/vmware/sddc-support/sos --health-check
    |  11 | VMware Aria Suite Lifecycle : <vrslcm.example.com> | NTP Status |  RED  |

Environment

  • VMware Cloud Foundation 5.x

Cause

The AttributeError is a secondary failure triggered when the SOS tool fails to query the Aria API due to an SSLCertVerificationError. This occurs when the Aria Suite Lifecyle Manager Machine SSL certificate is expired, has an unsuitable purpose, or is not trusted by the SDDC Manager.

Resolution

To resolve this issue, renew the Aria Suite Lifecyle Manager certificate.

Powered by Wolken Software