Specifying a certificate with the set logging-server command fails with the message "An internal error occurred"

Products

• VMware NSX

Issue/Introduction

• Executing the set logging-server command on the NSX appliance while specifying a certificate fails with the following error:
  

  nsx_appliance> set logging-server <syslog_server>:<port> proto tls level info serverca <certificate_file> clientca <certificate_file> certificate <certificate_file> key <key_file>
  <Timestamp>
  % An internal error occurred, please retry execution again

• The following errors can be observed in the syslog:
  

  <Timestamp> nsx_appliance NSX <pid> - [nsx@6876 comp="nsx-manager" subcomp="cli" username="admin" level="ERROR" errorCode="('CLI107',)"] Error reading CA certificate file: /var/vmware/nsx/file-store/<certificate_file>#012Traceback (most recent call last):#012  File "/opt/vmware/nsx-cli/bin/python/cli/commands/node_common/node_syslog_exporters.py", line 256, in __call__#012    with open(ca_file) as fd:#012PermissionError: [Errno 13] Permission denied: '/var/vmware/nsx/file-store/<certificate_file>'
  <Timestamp> nsx_appliance NSX <pid> - [nsx@6876 comp="nsx-manager" subcomp="cli" username="admin" level="ERROR" errorCode="('CLI101',)"] Error occured while concurrently executing commands#012Traceback (most recent call last):#012  File "/opt/vmware/nsx-cli/bin/python/cli/server/cli_command_service.py", line 1347, in _invoke_command#012    request = executor.submit(transaction.execute_command)#012  File "/opt/vmware/nsx-cli/bin/python/cli/utils/concurrent_utils.py", line 44, in submit#012    result = method(*args)#012  File "/opt/vmware/nsx-cli/bin/python/cli/server/cli_command_session.py", line 312, in execute_command#012    self._execute_local_cli()#012  File "/opt/vmware/nsx-cli/bin/python/cli/server/cli_command_session.py", line 257, in _execute_local_cli#012    output = self.env.descriptor.invoke(self.env.cmd_list)#012  File "/opt/vmware/nsx-cli/bin/python/cli/descriptors/cli_command_descriptor.py", line 554, in invoke#012    return self._provider.invoke(#012  File "/opt/vmware/nsx-cli/bin/python/cli/utils/callback_utils.py", line 201, in decorator#012    return func(self, cmd_list, context, context_data,#012  File "/opt/vmware/nsx-cli/bin/python/cli/descriptors/cli_command_descriptor.py", line 1304, in invoke#012    return self._provider(cmd_list)#012  File "/opt/vmware/nsx-cli/bin/python/cli/commands/node_common/node_syslog_exporters.py", line 256, in __call__#012    with open(ca_file) as fd:#012PermissionError: [Errno 13] Permission denied: '/var/vmware/nsx/file-store/<certificate_file>'

• Checking the permissions of the certificate file reveals that it is missing group read permissions:
  

  root@nsx_appliance:~# stat -c "%A" /image/vmware/nsx/file-store/<certificate_file>
  -rwx------

Environment

VMware NSX

Cause

The certificate file requires read permissions for the www-data group.

Resolution

Contact Broadcom Support and provide the NSX appliance log bundle to resolve this issue.