Spectrum / VNA Integration failure due to SSL Certificate SAN mismatch

Products

• Network Observability
• Spectrum
• Virtual Network Assurance

Issue/Introduction

This article addresses connectivity failures and integration synchronization errors between DX NetOps Spectrum and Virtual Network Assurance (VNA). These issues often occur after an SSL certificate renewal or when the VNA integration is first configured.

Environment

DX NetOps Virtual Network Assurance (VNA)
DX NetOps Spectrum
All supported versions

Cause

The VNA integration requires a valid SSL certificate. Connectivity failures, "unable to synchronize" errors, or integration state errors in the OneClick console occur if:

1. The VNA SSL certificate has expired.
2. The certificate’s Subject Alternative Name (SAN) field does not contain the specific IP address or Fully Qualified Domain Name (FQDN) used for the integration.

Resolution

To resolve connectivity issues related to SSL configuration, please perform the following steps:

Verify Certificate Validity: Ensure the SSL certificate utilized by VNA is currently within its valid date range.
Inspect SAN Configuration: Use an OpenSSL client or certificate tool to inspect the certificate. Verify that the IP address (e.g., #.#.#.#) or FQDN used for the VNA integration is present in the Subject Alternative Name (SAN) extension.
Example configuration for SAN: SAN=dns:vna-server.example.com,ip:#.#.#.#
Update Certificate: If the SAN field is missing the required integration identifier, regenerate the certificate to include the correct entry.
Re-import and Restart: Import the updated certificate into the VNA truststore. Restart the VNA service to apply changes.
Re-verify Integration: Perform a connection test from the Spectrum OneClick Administration > VNA Configuration page to confirm the integration status is restored.

Additional Information

A successful "Test" button result in OneClick only verifies connectivity to /admin/ping. It does not guarantee that the full domain-sync channel will succeed, as that channel uses additional endpoints.
If you continue to see integration failures after ensuring the certificate SAN is correct, please review the catalina.out or stdout.log on the OneClick server for any specific javax.net.ssl handshake errors.