SMTP Configuration Fails in Aria Operations for Logs with error : "Can't verify identity of server "

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Users are unable to complete the SMTP server configuration in Aria Operations for Logs. Depending on the configuration, the following symptoms occur:

• When SMTP is configured with STARTTLS enabled, a local certificate validation error is received: "Can't verify identity of server <SMTP-IP>"

• When STARTTLS is disabled, the destination server rejects the connection with the error: "403 4.7.0 encryption too weak 0 less than 128"

Environment

Aria operations for logs 8.x

Cause

The failure is caused by a hostname mismatch during the TLS certificate verification process. The destination SMTP server strictly enforces TLS encryption, but Aria Operations for Logs is configured using an IP address. This IP address does not match the Fully Qualified Domain Name (FQDN) defined in the Common Name (CN) or Subject Alternative Name (SAN) fields of the SMTP server's SSL/TLS certificate.

Resolution

Update SMTP Configuration to Use FQDN:

• Access the Aria Operations for Logs UI and navigate to Configuration > SMTP.

• Replace the IP address in the SMTP Server field with the exact Fully Qualified Domain Name (FQDN) that matches the SAN or CN on the SMTP server's SSL/TLS certificate.

• Ensure STARTTLS Encryption is set to Enabled.

• Input the destination email and click Send Test Email.

• If the SMTP server utilizes an internal or self-signed certificate, a dialog box containing the certificate details will appear. Click Accept to explicitly add the certificate to the truststores of all nodes in the Aria Operations for Logs cluster.

• Click Save to apply the configuration.

Additional Information

Configure the SMTP Server for VMware Aria Operations for Logs