cacert.pem file 0 bytes after SSL certificate replacement in Aria Operations for Logs 8.18.x

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

 In VMware Aria Operations for Logs 8.18.x, you replaced the SSL certification through Lifecycle Manager (LCM), or generated a self-signed SSL cert. Then you observed that the /storage/core/loginsight/cidata/cassandra/config/cacert.pem file became 0 bytes on the nodes.

Environment

Aria Operations for Logs 8.18.x

Cause

There is an error in the custom-ssl-cerf script used during both Lifecycle Manager (LCM) and manual self-signed certificate replacement workflows. Instead of copying the new certificate, the script incorrectly zeros out the existing /storage/core/loginsight/cidata/cassandra/config/cacert.pem file.

Resolution

To resolve this issue, perform the following steps:

1. Access the Aria Operations for Logs node via SSH as root user.

2. Backup the cacert.pem file before you overwrite it: 

cp -p /storage/core/loginsight/cidata/cassandra/config/cacert.pem /storage/core/loginsight/cidata/cassandra/config/cacert.pem.backup

3. Copy the default cluster.pem certificate to the Cassandra configuration directory using the following command:

cp /usr/lib/loginsight/application/etc/certs/cluster.pem /storage/core/loginsight/cidata/cassandra/config/cacert.pem

Note: If you have a multi-node cluster, ensure this step is performed on all nodes.

Additional Information

Other side-affect that caused by /storage/core/loginsight/cidata/cassandra/config/cacert.pem being 0 bytes:

Unlock or Reset of Admin Password in Aria Operations for Logs Fails with error 'Unable to get user data. Possible Cassandra is down.'

Unable to connect to internal Cassandra database with cqlsh-no-pass