"Uninstall IO Filter" task fails with "Cannot complete the operation. See the event log for details. Failed to modify installation status of I/O filter"

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to remove the I/O filter (specifically the CDP adapter used by backup solutions like Rubrik), the uninstallation process fails and displays the below error message in the vCenter:

Cannot complete the operation. See the event log for details.
Failed to modify installation status of I/O filter, ###########################, on all hosts.

• As per /var/log/vmware/eam/eam.log in the vCenter:

YYYY-MM-DDTHH:MM:SSZ |  WARN | host-agent-4 | UninstallHostAgentJob.java | 195 | VIB url: <VIB or OVF URL> is not accessible or trusted, skipping the uninstallation.
com.vmware.eam.security.trust.NotTrusted: URL: <Localhost_URL> is not trusted
        at com.vmware.eam.util.http.impl.Utils.handleInvalidSslCertificate(Utils.java:31) ~[eam-server.jar:?]
        at com.vmware.eam.util.http.impl.UrlConectionHttpOps.urlPropertiesOf(UrlConectionHttpOps.java:108) ~[eam-server.jar:?]
        at com.vmware.eam.util.http.impl.RoutedHttpOpExecutor.urlPropertiesOf(RoutedHttpOpExecutor.java:115) ~[eam-server.jar:?]
        at com.vmware.eam.util.url.impl.URLChecker.getHttpURLProperties(URLChecker.java:207) ~[eam-server.jar:?]
        at com.vmware.eam.util.url.impl.URLChecker.getURLProperties(URLChecker.java:117) ~[eam-server.jar:?]
        at com.vmware.eam.util.url.impl.URLChecker.isAccessible(URLChecker.java:91) ~[eam-server.jar:?]
        at com.vmware.eam.job.UninstallHostAgentJob.uninstallVib(UninstallHostAgentJob.java:188) [eam-server.jar:?]
        at com.vmware.eam.job.UninstallAgentJob.runWorkflow(UninstallAgentJob.java:94) [eam-server.jar:?]
        at com.vmware.eam.job.AgentWorkflowJob.call(AgentWorkflowJob.java:93) [eam-server.jar:?]
        at com.vmware.eam.job.AgentWorkflowJob.call(AgentWorkflowJob.java:48) [eam-server.jar:?]
        at com.vmware.eam.async.impl.AuditedJob.call(AuditedJob.java:58) [eam-server.jar:?]
        at com.vmware.eam.async.impl.FutureRunnable.run(FutureRunnable.java:55) [eam-server.jar:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_452]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_452]
        at java.lang.Thread.run(Thread.java:750) [?:1.8.0_452]

Cause

• The SSL certificate is provided via the EAM API (using Agent.ConfigInfo.ovfSslTrust or Agent.ConfigInfo.vibSslTrust) and via the script /usr/lib/vmware-eam/bin/eam-utility.py

• The issue can occur due to one of the following SSL certificate problems:

  • Hostname Mismatch: The hostname specified on the SSL certificate does not match the file server's actual address.

  • Invalid Certificate: The SSL certificate is invalid (e.g., it is expired or malformed).

  • Certificate Propagation Error: The propagated SSL certificate does not match the actual certificate being used by the file server hosting the OVF and/or VIB URLs.

Resolution

Configure a leaf SSL certificate that is to be trusted for a specific VIB or OVF URL

1. Login to VCSA through SSH using root.
2. To install the certificate, run the below command:

 /usr/lib/vmware-eam/bin/eam-utility.py install-cert <VIB/OVF URL>

Note:

• The required <VIB or OVF URL> is logged in the /var/log/vmware/eam/eam.log file in the vCenter.

Additional Information

• The operation above can be reverted by running: eam-utility.py uninstall-cert <VIB/OVF URL>
• The agency owner can also do the SSL trust configuration via the EAM API. In this case, it takes precedence over the configuration made via the script /usr/lib/vmware-eam/bin/eam-utility.py.

EAM API call fails with CertificateNotTrustedFault or EAM agent has CertificateNotTrusted issue