Upgrading VCF 9.0 environment to 9.1 fails when trying to "Import VCF Operations in Fleet Lifecycle"

Products

VCF Operations for Networks

Issue/Introduction

Upgrading VCF 9.0.x environment to 9.1.0..0 fails when trying to "Import VCF Operations in Fleet Lifecycle"
The Fleet lifecycle 'Component import' task fails with errors such as:

Detail: I/O error on POST request for "https://<IP>:443/api/auth/login": Certificate for <IP> doesn't match any of the subject alternative names: []
The "Install components using SDDC lifecycle service" task fails with:

Unable to register components with VCF Operations.

This issue is not seen if VCF Operations for Networks 9.1.0 is freshly deployed.

Environment

VCF Operations 9.1.0.0
VCF Operations for Networks 9.0.x

Cause

In VCF 9.0.x and earlier, Operations LCM generated vRNI certificates without populating the Subject Alternative Name (SAN) field for the appliance IP. Starting in VCF 9.1, the Fleet Lifecycle service enforces strict certificate validation (including SAN matching) to comply with enhanced security requirements. Connectivity fails during hostname verification if the appliance IP is missing from the SAN field.

Resolution

To fix this, the VCF Operations for Networks Platform appliance(s) need to be updated with valid certificates containing IPs in SAN fields of certificates, via a script.

Script filename: rotate_vrni_certs.sh
Size: 47 KB
MD5 Checksum: 0A9CAC12A2AED222EFE0A490A38F9B17

Use the script attached to "Deploy VCF Management Components" task fails during "Import VCF Operations in Fleet Lifecycle" to clear stale legacy data from VCF Operations (Option 1). When the script has successfully completed its execution, the Deploy VCF Management Components task (VCF Operations UI > Build > Tasks) will be restarted in the VCF Operations UI.
When the task is completed successfully, re-run the script attached to "Deploy VCF Management Components" task fails during "Import VCF Operations in Fleet Lifecycle" to import the VCF Operations for Networks component (Option 2). This will fail with a similar certificate error and a message stating to use this KB article will be displayed.
Download the script attached to this article named rotate_vrni_certs.sh.
Transfer the script rotate_vrni_certs.sh to the platform node under the /home/support directory. Use a tool such as WinSCP to the platform node and login with username support to transfer the file.
SSH to the VCF Operations for Networks platform node where the script was copied and login with username support.
Validate the file exists under the /home/support directory.
```
ls -lrth
```
Validate that the checksum of the script matches the value noted above:
```
 sudo md5sum rotate_vrni_certs.sh
```
Execute the script with the verify parameter to verify if the current VCF Operations for Networks certificate needs to be replaced:
```
sudo bash ./rotate_vrni_certs.sh verify
```
Note: The results will be either OK or ERROR

[OK] All platform certificates are valid. No rotation needed.
[ERROR] Certification rotation is required on one or more nodes.
Re-run the script using the apply parameter to rotate the certificate.
1. If using a CA-signed certificate, copy the certificate, private key and CA chain files to the platform node where the script is being run and execute the script per the following syntax:
```
sudo bash ./rotate_vrni_certs.sh apply --cert <certificate-pem-file-path-here>  --key <private-key-pem-file-path-here>  --ca-chain <ca-chain-pem-file-path-here>
```
2. If using a self-signed certificate, the script can create a new self-signed certificate and update VCF Operations for Networks to use it.
```
sudo bash ./rotate_vrni_certs.sh apply --self-signed
```

Note: Output similar to the following should be returned:

[OK] Certificate rotation completed successfully on all nodes!

Use the script attached to "Deploy VCF Management Components" task fails during "Import VCF Operations in Fleet Lifecycle" to complete the import of VCF Operations for Networks (Option 2).

Additional Information

Subscribe to this knowledge article to get updates on this issue.

Attachments

rotate_vrni_certs.sh get_app