Malformed CA Bundle Syntax Causes Curl Errors with SSL Trust Anchors

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When executing a curl command or trying to automatically download files (such as a Log Insight agent) from a remote server via HTTPS, the connection fails during the SSL handshake phase.

Reviewing the terminal execution or a curl trace log reveals the following specific SSL trust anchor errors:

* SSL Trust Anchors:
* error adding trust anchors from file: /etc/pki/tls/certs/ca-bundle.crt
* SSL Trust Anchors:
* error adding trust anchors from file: /etc/pki/tls/certs/ca-bundle.crt
* closing connection #0

Environment

VMware Identity Manager 3.3.7

Cause

The Certificate Authority bundle file (/etc/pki/tls/certs/ca-bundle.crt) has corrupted syntax. An automated certificate update script or regeneration tool (rehash_ca_certificates.sh) glued a certificate's footer (-----END CERTIFICATE-----) directly to the subsequent certificate's header (-----BEGIN CERTIFICATE-----) on the exact same line without inserting a necessary newline character.

Because cryptography tools expect strict PEM formatting boundaries, the malformed text string -----END CERTIFICATE----------BEGIN CERTIFICATE----- prevents curl from properly reading and loading the system's trust anchors.

Resolution

To resolve this issue, use a stream editor (sed) to find the malformed string inside the CA bundle and restore the missing newline character.

1. Log into the affected node as the root user via SSH.

2. Create a backup of the existing CA bundle file to ensure you have a fallback configuration:

   cp /etc/pki/tls/certs/ca-bundle.crt /home/root/ca-bundle.crt.bak
   

3. Run the following sed command to inline-edit the file and insert the correct newline break (\n) between the glued certificates:

   sed 's/-----END CERTIFICATE----------BEGIN CERTIFICATE-----/-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----/g' -i /etc/pki/tls/certs/ca-bundle.crt
   

4. Test the connection again with your original curl command to verify that the download works and the SSL handshake completes successfully.