Replacing the SSL certificate in Aria Operations 8.x fails with the error message: "Multiple leaf certificates (Primary SSL) are found. Provide only one leaf certificate".

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Replacing the SSL certificate in Aria Operations fails during the installation or validation phase. When validating the .pem file using the Custom Certificate Tool, the following (or similar) parsing errors are displayed:

• ERROR: Multiple leaf certificates (Primary SSL) are found. Provide only one leaf certificate.

• ERROR: Extra certificates are present in the certificate file which don't belong to the chain.

• ERROR: Root/Final certificate in chain is not self-signed. You are probably missing one or more certificates in the chain.

Environment

VMware Aria Operations 8.x

Cause

The .pem file provided for the SSL replacement contains an incorrect certificate in the chain somewhere, disrupting the certificate chain and causing the parser to incorrectly identify multiple leaf certificates.

Resolution

1. Open the failing .pem file in a standard text editor.

2. Open each certificate and key utilizing Microsoft Certificate viewer to confirm the correct signing CA and order.

3. Review the certificate chain blocks to identify the incorrect certificate.

4. Remove the incorrect certificate block from the file.

5. Insert the correct intermediate CA certificate into the .pem file. Ensure the certificate chain is arranged in the strict order required by Aria Operations: Server/Leaf Certificate  -> RSA Private Key -> Intermediate CA Certificate(s) -> Root CA Certificate 

6. Save the modified .pem file.

7. Validate the corrected .pem file using the Custom Certificate Tool to ensure no parsing errors remain.

8. Upload and install the corrected .pem file through the Aria Operations Admin UI.

Additional Information

Using the Custom Certificate Tool in VMware Aria Operations