Nutanix_monitor probe fails to accept SSL certificate

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

When configuring the nutanix_monitor probe with an SSL connection, the probe fails to connect.  The probe logs show that it fails to find a valid certificate:

Jan 14 10:04:05:583 [Connection tester - 0, nutanix_monitor] com.ca.uim.probe.nutanix_monitor.service.NutanixWebServiceException: Failed to connectjavax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Checking the packets with Wireshark also show that certificate is unknown:

Environment

• UIM 23.4.x
• Nutanix_monitor probe 1.62+

Cause

The nutanix_monitor does not automatically accept self-signed certificates, or a certificates signed by an internal enterprise CA.  These are not trusted by default.  Therefore, the probe's HTTPS client (Java) rejects the connection silently or with SSL handshake errors.

Resolution

To allow self-signed or interally signed certificates, these need to be manually added to the keystore.  You can do this using the following steps:

• Access nutanix prism central url from browser, https://<HostName>/PrismGateway/services/rest/v2.0 and download the browser certificate by exporting it.
• Put this certificate in the jre folder of the UIM robot where the Nutanix probe is running. The Nutanix probe runs on JRE 8, therefore put the certificate file into the JRE8 folder.
  • <InstallationFolder>\Nimsoft\jre\jre8u472b08\bin is the latest JRE folder
• Now open command prompt and CD into the directory <InstallationFolder>\Nimsoft\jre\jre8u472b08\bin
• Use the below command to import the certificate : (Replace filename with exact certificate name and aliasname should be some appropraite name such as NutanixServer1)
       keytool -import –trustcacerts -keystore <InstallationFolder>\Nimsoft\jre\jre8u472b08\lib\security\cacerts -file filename -alias aliasname
• Deactivate and activate the Nutanix probe.