DX NetOps Upgrade Fails with "Public Key Retrieval is not allowed" due to missing or corrupt MySQL PEM files

Products

• Network Observability
• CA Performance Management

Issue/Introduction

When upgrading DX NetOps (Performance Management), the installation or the DBMigrateApp phase fails with the following error: "Public Key Retrieval is not allowed"

Upon investigation of the MySQL data directory, required SSL certificate files (PEM) are missing, incomplete, or exist only as backup files (e.g., server-cert.pem.bak exists but server-cert.pem is missing).

Environment

• DX NetOps Performance Management (all versions)
• MySQL 8.x

Cause

MySQL 8.4 and later versions utilize SHA-2 authentication which requires a valid RSA key pair for password exchange when SSL is not fully established or when "Public Key Retrieval" is requested. If the underlying PEM files in the MySQL data directory are missing or mismatched, the database engine cannot provide the necessary public key to the JDBC client, resulting in a connection failure.

Resolution

To resolve this, you must allow MySQL to regenerate the default SSL certificates and then re-run the upgrade.

1. Stop DX NetOps Services: Stop the four core Performance Center services:

   bash

    

   systemctl stop caperf*

2. Stop MySQL Service:

   bash

    

   systemctl stop mysql

3. Clear Existing PEM Files: Move the existing (potentially corrupt or incomplete) PEM files out of the MySQL data directory to a temporary backup location:

   bash

    

   cd /opt/CA/MySQL/data/
   mv *.pem* /tmp/

4. Regenerate Certificates: Start the MySQL service. MySQL will automatically detect the missing certificates and regenerate a fresh set of .pem files in the data directory:

   bash

    

   systemctl start mysql

5. Verify Certificate Generation: List the directory to ensure all standard PEM files (including server-cert.pem and server-key.pem) have been created:

   bash

    

   ls -al *.pem

   Note: You should see ca-key.pem  ca.pem  client-cert.pem  client-key.pem  private_key.pem  public_key.pem  server-cert.pem  server-key.pem 

6. Restart DX NetOps Services: Once MySQL is verified as running with valid certificates, start the remaining services:

   bash

    

   systemctl start caperfcenter_sso caperfcenter_eventmanager caperfcenter_devicemanager caperfcenter_console

7. Resume Upgrade: Perform an in-place upgrade by running the installer again on top of the existing failed installation.