Updating Various Certificates in Aria Automation Orchestrator

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Aria Automation Orchestrator utilizes several types of certificates for client communication, 
internal component communication (gRPC), and external integrations. 
If any of these certificates expire, it can cause critical issues. 
Since these certificates do not renew automatically, an expired certificate may lead to unexpected communication failures.

Environment

VMware Aria Automation Orchestrator 8.18.x

Cause

The issue occurs when one or more of the following certificates used by Orchestrator expire. 
Because these certificates do not have an auto-renewal feature, they must be updated manually or via specific workflows.

• Ingress Certificate: Used for client communication (utilized by Envoy for external communications).
• Internal Certificate: Used for gRPC communication between Contour and Envoy.
• Keystore (Dunes / SSO / CA Keystore): Used for external system integration, package signing, etc.

Resolution

Check the expiration dates of the target certificates. If they have expired or are nearing expiration, 
perform the update using the following methods:

1. Ingress Certificate
      Usage: Used for client communication (utilized by Envoy for external communication on port 443).
      Validity Period: 5 years (No auto-renewal).
      Verification Command:
      ・ vracli certificate ingress -list | openssl x509 -dates --noout
      Update Procedure: Perform a manual update. For details on the steps, please refer to How to generate a TLS certificate in a standalone Aria Automation Orchestrator 8.18.1
2. Internal Certificate
      Usage: Used for gRPC communication between Contour and Envoy.
      Validity Period: 1 year (No auto-renewal).
      Verification Commands:
      ・ kubectl get secret -n prelude envoycert -o jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -dates --noout
      ・ kubectl get secret -n prelude contourcert -o jsonpath='{.data.ca\.crt}' | base64 -d | openssl x509 -dates --noout
      Update Procedure: Perform a manual update. For details on the steps, please refer to After the reboot, the container 'contour-envoy-#####' is no longer starting.
3. Keystore (Dunes / SSO / CA Keystore)
      Verification Path: Navigate to [Administration] > [Inventory] > [configuration] > [Keystores] in the GUI.
      Update Procedure: The required action depends on the certificate type (none of them support auto-renewal).
   
   • Dunes (Used as a self-signed certificate for package exporting / Validity: 10 years):
     Run the "Generate Package Signing Certificate" workflow to update it. For details, refer to How to re-generate certificates in Dunes keystore for Standalone Aria Automation Orchestrator.
   • SSO (Used for integration with vCenter or external SSO / Validity depends on the issuer):
     Import the certificate from vCenter or the respective identity provider. For details, refer to How to Configure the Automation Orchestrator Appliance authentication provider on 8.18.x.
   • CA Keystore (Used by the internal Java process (vco-app) for external integration (such as vCenter) during workflow execution or package signing / Validity depends on the issuer):
     Run the corresponding update workflow. For details, refer to How to import a trusted certificate to the keystore in VCO..

 

 

 

Additional Information

How to generate a TLS certificate in a standalone Aria Automation Orchestrator 8.18.1

After the reboot, the container 'contour-envoy-#####' is no longer starting

How to re-generate certificates in Dunes keystore for Standalone Aria Automation Orchestrator

How to Configure the Automation Orchestrator Appliance authentication provider on 8.18.x

How to import a trusted certificate to the keystore in VCO.