Handshake_failure(40) prevents organization migration in VCF Automation 9.0.2

Products

VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

After upgrading from VMware Aria Automation 8.18.1 to VCF Automation (VCFA) 9.0.2, organizations are not visible in the Provider Management portal.

Symptoms

vIDM integrated with Aria Automation 8.18.1 uses ECDHE-RSA-AES128-GCM-SHA256 cipher :
Command openssl s_client -connect <vIDM_FQDN>:443 -servername <vIDM_FQDN> -tls1_2 -showcerts </dev/null gives the below output :
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES128-GCM-SHA256

data-migration-prelude-run-hook log shows the below error :

YYYY-MM-DDTHH:MM:SS.####Z stderr F     raise RuntimeError(f"VIDM connection test failed: {conn_data}")
YYYY-MM-DDTHH:MM:SS.####Z stderr F RuntimeError: VIDM connection test failed: {'targetProbe':
{'result': 'ERROR - Unable to establish SSL connection: org.bouncycastle.tls.TlsFatalAlertReceived: handshake_failure(40)', 'resolvedIp': '<vIDM_IP>', 'canConnect': True, 'sslHandshake': False, 'connectionResult': 'SUCCESS', 'sslResult': 'ERROR_SSL_ERROR', 'certificateChain': None, 'additionalCAIssuers': []}
, 'proxyProbe': None}

Attempts to test the VMware Identity Manager (vIDM) connection from Administration > Certificate Management > Trusted Certificates > Test Connection to URL fails with the below error in Provider Management portal :
```
ERROR: Unable to establish SSL connection: 
org.bouncycastle.tls.TlsFatalAlertReceived: handshake_failure(40)
```

Environment

VCF Automation 9.0.2

Cause

VCF Automation (VCFA ) 9.0.2 is configured by default to support specific modern SSL protocols and cipher suites. If the VMware Identity Manager (vIDM) is configured with older protocols or ciphers such as ECDHE-RSA-AES128-GCM-SHA256 that are explicitly disallowed in the VCFA configuration, the SSL handshake fails. Because the Tenant Manager cannot establish a secure connection to vIDM, it cannot retrieve the required data to create the organizations after migration.

Resolution

Note : Do not proceed with the below steps without an on-demand backup of VCF Automation .

SSH to one of the VCF Automation nodes using vmware-system-user account, switch to root user sudo su - and perform :

Edit the VCFA configuration map:
kubectl -n prelude edit configmap tenant-manager-scripts

Modify the disallowed ciphers list: In the common.sh section, append ssl.ciphers.disallowed just above the EOF and save the configuration using :wq!

restapi.baseHttpUri=${HTTP_URI}
ui.baseHttpUri=${HTTP_URI}
phone.home.enabled=${CEIP_STATUS}

ssl.ciphers.disallowed=TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA
EOF

Restart the statefulset:

kubectl rollout restart statefulset/tenant-manager -n prelude
Re-run the migration webhook :
1. Initialize token

k8s_token=$(kubectl get secrets synthetic-checker-krp -n vmsp-platform -ojsonpath=\{.data.token} | base64 -d)
2. Invoke webhookcurl -k -X POST https://localhost:30005/webhooks/prelude/data-migration/run -H "Authorization: Bearer $k8s_token"

Additional Information

If the issue persists, contact for Broadcom Support further assistance.

Subscribe to this article to receive updates on fix status: Subscribe to a Broadcom knowledge article by article or product