Error: No chain when applying custom certificates - VCF Operations for Networks

Products

• VCF Operations for Networks

Issue/Introduction

After upgrading VCF Operations for Networks from 6.12.1 to 6.14.2 via Aria Suite Lifecycle, attempts to replace or renew SSL certificates fail. The CLI command custom-cert apply returns the error: Error: No chain. Third-party certificate validation tools (such as cnacertmgmt.cna.com) indicate an incomplete certificate chain of trust.

• Certificate validation fails with a "no chain" error.
• CLI command custom-cert apply fails during the application process.

Environment

• VCF Operations for Networks 6.14.2
  
  
• Aria Suite Lifecycle
  
  
• Platform Node 1

Cause

The custom-cert apply utility requires the certificate (.crt) file to contain the complete hierarchical chain of trust in a single file. This issue occurs when the provided certificate file lacks intermediate CA certificates or the Root CA certificate, or if the certificate blocks are in the incorrect order. Both the .crt and .key files must reside in the /home/ubuntu/custom-certs/ directory on Platform Node 1 for the CLI to successfully bind the certificates.

Resolution

Construct a complete certificate chain and apply it via the Platform Node CLI.

Prerequisites

1. Establish a revert point/snapshot per KB 314428 - Best practices to shutdown VCF Operations for Networks Clustered deployments.
2. Open an SSH session to Platform Node 1 as the consoleuser.

Procedure

1. Create a single .crt file (e.g., combined_cert.crt) containing the certificate blocks in this exact hierarchical order:
   • End-entity (Server) Certificate
   • Intermediate CA Certificate(s)
   • Root CA Certificate
2. Transfer the .crt and .key files to /home/support/ on Platform Node 1 using the support user via SCP.
3. In the Platform Node 1 SSH session, switch to the Ubuntu user: ub
4. Move the files to the staging directory: sudo mv /home/support/<filename>.crt /home/ubuntu/<filename>.crt sudo mv /home/support/<filename>.key /home/ubuntu/<filename>.key
5. In the consoleuser session, remove any failed certificate attempts: custom-cert remove
6. In the ub session, move the new files to the active custom-certs directory: sudo mv /home/ubuntu/<filename>.crt /home/ubuntu/custom-certs/<filename>.crt sudo mv /home/ubuntu/<filename>.key /home/ubuntu/custom-certs/<filename>.key
7. In the consoleuser session, apply the new certificate: custom-cert apply
8. Verify application success by logging into the VCF Operations for Networks GUI.

 

Additional Information

If further assistance is required, see Contact Support. Scroll to the bottom of the page and click on the respective region to speak with a customer representative or a Support Engineer.