utf-8 certificate cannot be installed in Aria Automation

Products

• VCF Automation

Issue/Introduction

Replace certificate failed with below error in Aria Suite Lifecycle.

Error Code: LCMVRAVACONFIG590020
VMware Aria Automation VA Certificate Installation Failed

Failed to install vRA Certificate on hostname : xxxxxxxx . Please refer to vRSLCM logs for more details. To retry with same certificate submit the retry request. To retry with a new certificate, set the 'retryDifferentCertificate' property to true . Optionally, to skip the certificate update task, set the 'skipCertificateUpdate' property to true. at com.vmware.vrealize.lcm.plugin.core.vra.task.VraVaInstallCertificateTask.execute(VraVaInstallCertificateTask.java:158) at com.vmware.vrealize.lcm.automata.core.TaskThread.run(TaskThread.java:62) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source)

/var/log/vmware/prelude/certificate-manager.log

certificate - INFO - message: The private key was removed.<Date & Time> - certificate - WARNING - message: Unable to parse certificate's ['v3_extensions'] section. 'utf-8' codec can't decode byte 0xf1 in position 171: invalid continuation byte skipping. - certificate - INFO - message: Certificate sha256: - certificate - INFO - message: The private key was removed.- certificate - WARNING - message: Unable to parse certificate's ['v3_extensions'] section. 'utf-8' codec can't decode byte 0xf1 in position 171: invalid continuation byte skipping.

Environment

Aria Automation 8.18.1

Cause

The issues seems to be that the python certificate library Aria Automation uses has an issue parsing X509v3 Certificate Policies ->Policy -> User Notice -> Explicit Text when the representation is UTF8String.

Resolution

Run the below script to replace the certificate in Aria Automation directly.

CERT_FILE=<certs.pem>
CHAIN_JSON=$(awk '
    /-----BEGIN/ { if (block) printf "%s\0", block; block = "" }
    { block = block $0 "\n" }
    END          { if (block) printf "%s\0", block }
  ' "$CERT_FILE" | jq -Rs '[split("\u0000") | .[] | select(startswith("-----BEGIN"))]')

echo $CHAIN_JSON

kubectl get vaconfigs.prelude.vmware.com prelude-vaconfig -o json \
      | jq --argjson chain "$CHAIN_JSON" '.certificates.ingress = $chain' \
      | kubectl replace -f -

Note: Replace certs.pem and mention the Certificate file name with the location.

Ensure the certificate chain order is,

• Private Key
• SSL Cert
• Intermediate 
• Root CA

If the certificate replacement completed in Aria Automation. Run /opt/scripts/.deploy.sh and ensure all the pods are running.