VMware Aria Automation Orchestrator custom certificate ingress fails with "rsa routines invalid padding"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

You encounter an error when attempting to apply a custom ingress certificate for VMware Aria Automation Orchestrator. When executing the vracli certificate ingress --set command, the service fails to start and returns the following error:

The public key derived from the certificate does not correspond to the private key supplied: [('rsa routines', '', 'invalid padding'), ('rsa routines', '', 'padding check failed'), ('Provider routines', '', 'RSA lib')]

Environment

VMware Aria Automation Orchestrator 8.x

Cause

This issue occurs because the custom certificate obtained from the Certificate Authority (CA) does not match the private key used to generate the Certificate Signing Request (CSR).

Resolution

To confirm if the certificate and private key are mismatched, you can compare the extracted public keys from both files using the following steps:

1. Extract the public key from the certificate:

openssl x509 -pubkey -noout -in certificate.crt > cert_pub.pem

2. Extract the public key from the private key:

openssl pkey -pubout -in private.key > key_pub.pem

3. Compare the two files:

sdiff cert_pub.pem key_pub.pem

If the sdiff output shows that the public keys do not match, the certificate is invalid for that specific private key.

Permanent Fix: To permanently resolve this issue:

1. Provide the original private.key and CSR file to your CA and request that they generate and validate a matching certificate.

2. Once the matching certificate is obtained, import it following the steps in the official documentation: Set a custom TLS certificate for VMware Aria Automation Orchestrator.

Additional Information

Additional Information Workaround:

If you need to bring the VMware Aria Automation Orchestrator service up immediately, you can install a self-signed certificate as a temporary workaround. For instructions, see Generate a new VMware Aria Automation Orchestrator SSL certificate.