VCF Operations for Networks Certificate Renewal via Fleet Fails with "Invalid Provider Error"

Products

• VCF Operations
• VCF Operations for Networks

Issue/Introduction

In the VCF Operations Console under Fleet Management, the Aria Operations for Networks certificate displays as expired. Clicking "Renew Certificate" redirects to an unreachable page.

After applying the default SSL certificate by following the procedure rotate_vrni_certs.sh, the UI continues to display the expired date. Executing an Inventory Sync fails with the following error:

Error Code:
LCMVRNICONFIG90045
Failed to get CSRF token for Operations-networks.
Validate if the IP address, credentials are correct, and all services are running.

Attempting to apply a custom CA-signed certificate may also fail with the error: "The Provider certificate content is invalid Only PEM encoded certificates are supported."

Environment

VMware Cloud Foundation Operations 9.x 

Aria Operations for Networks 9.x 

Cause

The CA-signed certificate renewal fails because the Certificate Signing Request (CSR) was generated via the command line interface rather than the Fleet UI, resulting in a non-PEM encoded certificate format being supplied to the provider.

Resolution

 

• Renew the existing expired certificates with the default SSL certificate by following Broadcom KB 440459.

• Remove the Aria Operations for Networks component from VCF Ops Fleet Management.

• Delete the old expired certificate from the certificate section.

• Re-import the component back into the environment.

• Perform an Inventory Sync to reflect the updated default certificate validity.

• Generate a new Certificate Signing Request (CSR) directly from the VCF Operations Fleet UI instead of the command line.

• Have the internal Certificate Authority (CA) sign the newly generated CSR.

• Apply the properly PEM-encoded, CA-signed certificate to complete the renewal process.