Applying a profile from Fleet Management on a foundation fails with certificate_unknown

Products

• VMware Tanzu Platform Core

Issue/Introduction

When Applying a profile using profile management on a foundation the upload operations might fail with  error:

[ERROR]UPLOAD_TILE - Capability upload to OpsManager failed for harbor-container-registry: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

 

Environment

Opsman 3.3 

Tanzu Hub 10.4.2

 

Cause

The container responsible for upload of the artefacts required for deployment of the specified profile is using internal subcomponent for upload process which is acting as a proxy, however if the foundation is attached with Certificate specified in the field during foundation attach process. This certificate is imported into the container and forcing the container to verify the server, but due to certificate mismatch the container fails with above error. 

Resolution

This is a problem identified in tanzu hub 10.4.2 and will be addressed in the future releases.

It is Recommended if Foundation Core uses a custom or self-signed certificate so that Tanzu Hub can validate the Foundation Core certificate, however If a certificate is not provided, TLS will not be validated.

As a workaround attachment of a foundation without adding a certificate would allow the container to perform its steps without verifying the certificate