VCF Automation Upgrade to 9.x Fails FIPS Precheck Due to Legacy Configuration of Integrated Endpoints or Issue with the Endpoints
search cancel

VCF Automation Upgrade to 9.x Fails FIPS Precheck Due to Legacy Configuration of Integrated Endpoints or Issue with the Endpoints

book

Article ID: 447667

calendar_today

Updated On:

Products

VCF Automation

Issue/Introduction

During an upgrade to VCF Automation 9.x, the pre-upgrade health check fails with an error similar to:

Precheck failed: com.broadcom.vcfa.upgrade.90.application.check.test-application-01-9x-fips
"One or more configured endpoints or integrations are not accessible in FIPS mode."
"Review /tmp/vcfa-upgrade/logs/fipschecker.log and /tmp/vcfa-upgrade/logs/fips-checks-failed on the source system for details. Configure the failing endpoints to be accessible in FIPS mode."

Note: For Aria Automation 8.18.x will show a similar error message containing test-application-02-8x-fips.sh. Precheck logs for 8.18.x are located in /var/log/vmware/prelude/.

The upgrade is blocked and cannot proceed. This may affect environments with any of the following configurations:

  • An IPAM integration endpoint configured with skip certificate check flag to 'on'
  • A vROps (VMware Aria Operations) integration endpoint
  • An LDAP directory integration configured using plain LDAP (ldap://) instead of LDAPS (ldaps://)

Environment

VCF Automation 9.x

Aria Automation 8.18.x 

Cause

VCF Automation 9.x enforces FIPS 140-2 compliance for all external integration endpoints. The pre-upgrade check (test-application-01-9x-fips) validates that every configured integration communicates over a secure, certificate-backed channel.

Legacy integrations created in earlier versions of vRealize Automation / Aria Automation may have been configured before this requirement was enforced, resulting in:

  • IPAM endpoint configured without a certificate with skip certificate validation flag set to 'on'
  • LDAP directory integrations using the unencrypted ldap:// protocol on port 389
  • vROps endpoints by default store the certificate so that prechecks cannot access it and validate it properly

These configurations do not satisfy FIPS requirements and are flagged as blockers.

Resolution

The recommended resolution is to update/recreate each incorrectly configured integration to use a secure, certificate-backed connection before retrying the upgrade.

Fix IPAM Endpoints

  1. In the VCF Automation UI, navigate to Infrastructure → Integrations.
  2. Locate integrations of type IPAM
  3. Click Edit integration and modify the skip certificate validation flag to 'off', and click Save
  4. A prompt for accepting the new certificate would appear if the certificate is not trusted/selfsigned (click OK to trust), then the endpoint certificate will be validated and stored for this endpoint
  5. Re-run the upgrade pre-checks to confirm the issue is resolved

Fix LDAP Directory Integration (ActiveDirectory)

  1. Navigate to Infrastructure → Identity & Access Management → Directories.
  2. Locate the LDAP directory using ldap://.
  3. Edit the directory configuration and switch to ldaps:// with the appropriate port (default: 636).
  4. Provide the LDAP server's CA certificate (the UI will automatically prompt for acceptance if the provided certificate is not trusted/selfsigned)
  5. Save and re-run the upgrade pre-checks

Note: Coordinate with your LDAP/Active Directory administrator to obtain the correct server certificate and confirm port 636 is accessible from the VCF Automation appliance.

Fix vROps Integration Endpoints

For vRA 8.18.x Source Upgrades

The only way is to skip the precheck for this endpoint integration type. SSH to the vRA node(s):

  1. Create directory /var/run/dropins
  2. Create/edit file /var/run/dropins/vra_fips_precheck_endpoints.list Put a one liner white list of the integration endpoints to be handled by prechecks: The full white list is: 'vsphere','nsxt','activedirectory','org.bitbucket','com.github.saas','com.gitlab.saas','ipam','vro','vrops'
  3. To skip VROPS endpoint check you can create file: /var/run/dropins/vra_fips_precheck_endpoints.list 'vsphere','nsxt','activedirectory','org.bitbucket','com.github.saas','com.gitlab.saas','ipam','vro'

Note: You can skip the same way as "VROPS" either of the previous failing endoints "IPAM", "ActiveDirectory" if the resolution for them does not work

For VCF 9.x Source Upgrades

  1. Create directory /tmp/vcfa-upgrade/dropins
  2. Create/edit file /tmp/vcfa-upgrade/dropins/vcfa9_fips_precheck_endpoints.list
  3. To skip VROPS endpoint check you can create file: /tmp/vcfa-upgrade/dropins/vcfa9_fips_precheck_endpoints.list 'vsphere','nsxt','activedirectory','org.bitbucket','com.github.saas','com.gitlab.saas','ipam','vro'

Note: You can skip the same way as "VROPS" either of the previous failing endpoints "IPAM", "ActiveDirectory" if the resolution for them does not work

Here is the IPAM configuration screen in the UI and you can use this for reference, note 'Infoblox.IPAM.DisableCertificateCheck' flag that should be edited in the resolution instructions:

Powered by Wolken Software