Error: curl: (60) SSL certificate OpenSSL during 'agctl selfcheck'

Products

• VMware Telco Cloud Automation
• VMware Telco Cloud Platform

Issue/Introduction

When running the agctl selfcheck system command in an airgapped environment, the health check fails for the Web Service and Harbor Service components. The command returns the following error:

curl: (60) SSL certificate OpenSSL verify result: self-signed certificate in certificate chain

This indicates that curl cannot verify the legitimacy of the local server due to an untrusted self-signed certificate chain.

Environment

TCA 3.4

TCP 5.1

Airgap 3.4

Cause

The host system's OpenSSL trust store was missing the local server's CA/root certificate (ca.crt_localairgap), preventing curl from validating the self-signed certificate chain used by the local Harbor and Web services.

Resolution

• Copy the Certificate to the System Trust Store: Copy the local airgap certificate to the /etc/ssl/certs/ directory:

  cp /usr/local/airgap/certs.<timestamp>/ca.crt_localairgap /etc/ssl/certs/ca_localairgap.pem

• Update Certificate Symlinks: Rehash the CA certificate store so OpenSSL recognizes the newly added certificate

  rehash_ca_certificates.sh

• Verify System Status: Re-run the health check to confirm the SSL verification error is resolved:

  agctl selfcheck system