When trying to configure DSM to use S3 storage for logs and backups it fails with the error "tls: failed to verify certificate: x509: certificate"

Products

• VMware Data Services Manager for VCF

Issue/Introduction

When trying to configure DSM to use S3 storage for logs and backups, it fails with the following error.

admission webhook "backuplocations.databases.dataservices.vmware.com" denied the request: unable to connect to s3 compatible storage: operation error S3: HeadBucket, exceeded maximum number of attempts, 3, https response error StatusCode: 0, RequestID: , HostID: , request send failed, Head "https://vmwaredsm.vsa-0000002d-ctl-#######-01.#########.com:443/v1/AUTH_##########f9f0ecd": tls: failed to verify certificate: x509: certificate is valid for *.########.com, #########.com, not vmwaredsm.vsa-0000002d-ctl-##########-01.###########.com

Environment

VMware Data Services Manager for VCF 2.2.3

Cause

From the error message it was identified a certificate related error

The error message "tls: failed to verify certificate: x509: certificate is valid for *.########.com, #########.com, not vmwaredsm.vsa-0000002d-ctl-##########-01.###########.com" indicates a problem with the TLS/SSL certificate presented by a server during a connection attempt. Specifically, it means the hostname you are trying to connect to does not match the hostnames listed in the certificate's Subject Alternative Names (SANs) or Common Name (CN) field.

Resolution

Work with the storage vendor to ensure the certificate on the server includes the correct hostname (or IP address) in its SANs or CN.

Additional Information

Wildcards in the certificate only cover 1 level of subdomains. So if your wildcard is *.###########.com, then only test.#########.com or org.##########.com would work.

But because they have 2 levels: vmwaredsm and vsa-0000002d-ctl-#######-01, this certificate won't work.

 

Configure a Custom Certificate for VMware Data Services Manager Provider VM

Configuring Provider Backup Settings