"Error decrypting data. - Given final block not properly padded. Such issues can arise if a bad key is used during decryption." while accessing Certificates Library from VCD provider portal

Products

• VMware Cloud Director

Issue/Introduction

• Navigate to VCD provider portal > Administration > Certificate Management > Certificates Library > Fails to load the certificates and throws an error message "Error decrypting data. - Given final block not properly padded. Such issues can arise if a bad key is used during decryption."

• As a result, the relevant certificates are unavailable during the cell-level replacement process outlined below:

1. Navigate to Provider Portal > Resources > Cloud Resources > Cloud Cells
2. Select One of the cells > Click "Endpoints Configuration" > Edit
3. Select Web Server Or JMX Edit placeholder > It can't list the certs and display the same error message "Error decrypting data. - Given final block not properly padded. Such issues can arise if a bad key is used during decryption."

• In /opt/vmware/vcloud-director/logs/vcloud-container-debug.log, you see the error reported below:

YYYY-DD-MM 15:34:22,756 | ERROR    | pool-jetty-374            | DefaultExceptionMapper         | Internal server exception | requestId=########-####-####-####-############,request=GET https://VCD_FQDN/cloudapi/1.0.0/ssl/certificatelibrary,requesttime=1765265662696,remoteaddress=##.##.##.##:####,useragent=mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...,accept=application/json;version 40.0.0-alpha
com.vmware.vcloud.common.crypto.CryptoException: Error decrypting data.
        at com.vmware.vcloud.common.crypto.AesEncryption.Decrypt(AesEncryption.java:134)
        at com.vmware.vcloud.common.crypto.AesEncryption.Decrypt(AesEncryption.java:148)
 ....
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.
        at java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:981)

Environment

VMware Cloud Director 10.6.x

Cause

This issue is caused by an incorrect database entry associated with a stale (decommissioned) VCD cell that is no longer part of the current VCD infrastructure. The stale cell contains a corrupted pass_phrase_key, which results in the decryption failure.

Resolution

This issue requires database modification.

To resolve this issue, contact Broadcom Support and note this Article ID (423011) in the problem description. For more information, see Creating and managing Broadcom support cases.