Install components using SDDC lifecycle service upgrade task fails when VCF Operations for Networks 9.0.x certificate contains SAN entries for platform node IP addresses

Products

• VCF Operations for Networks
• VCF Operations

Issue/Introduction

• An upgrade from VCF 9.0.x to 9.1.0.0 is underway.
• The LCM (Lifecycle Management) task fails during the component discovery phase. The error message is
  
  An unexpected error occurred in step discover_vrni_component_task_ref. Reference Code: ########
Please contact support with this reference code. Detail: I/O error on POST request for "https://<VCF Operations for Networks IP>:443/api/auth/login": Certificate for <VCF Operations for Networks IP> doesn't match any of the subject alternative names: []
  
  
  
• The certificate in use by VCF Operations for Networks does contain the noted IP address as a Subject Alternative Name (SAN) record in the certificate. This can be validated by running the following command on the VCF Operations for Networks platform node:
  
  openssl s_client -connect localhost:443 |openssl x509 -text -noout
  
  <truncated>
  X509v3 Subject Alternative Name:
                DNS:<VCF Operations for Networks IP>, DNS:<VCF Operations for Networks FQDN>
<truncated>
  
  
  

Environment

• VCF Operations 9.1.0.0
• VCF Operations for Networks 9.0.x

 

Cause

The certificate in use by VCF Operations for Networks has the management IP addresses incorrectly categorized within the Subject Alternative Name (SAN) field. Specifically, the IP addresses are defined as DNS entries instead of IP Address entries. 

Modern TLS validation requires that IP addresses used in the connection URL must be explicitly matched against entries of type `IP Address` in the SAN field, not `DNS` entries.

Resolution

Use the steps in Upgrading  VCF 9.0 environment to 9.1  fails when trying to "Import VCF Operations in Fleet Lifecycle"  to replace the certificate in use by VCF Operations for Networks and resume the upgrade. Ensure that the IP Address and DNS SAN records are populated correctly.