Certificate Alerts following upgrade to VCF 9.1.1

Products

• VCF Operations

Issue/Introduction

In vRealize Operations appliance you receive the following alerts:

• VCF Management Services internal certificate renewal is overdue
• VCF Management Services internal certificate rotation failure detected
• VCF Management Services internal certificate has expired

These may or may not be accompanied by following symptoms:

• Identity Broker encountered an issue during authentication.
• Unable to complete the login process due to
  a system error.
• general.login.error

Clearing the alerts results in them coming back 1 hour later.

Environment

VCF Operations 9.1.1

Cause

The failure is caused by an issue in the Postgres certificate used by the Identity Broker.

Resolution

The Broadcom Engineering team is aware of this issue, and a fix is planned for an upcoming release.

As a workaround, regenerate the PostgreSQL certificate secret:

1. Establish an SSH connection to a VCF Services Runtime instance. Refer to the documentation for Enabling SSH Access to the VCF Services Runtime Cluster.

2. Rotate and Verify Certificate. Perform the following sequence to rotate the certificate:

   A. Capture Current Details Run this command to capture the existing certificate request details:

   kubectl get certificaterequest -n vidb-external -o yaml
   

   b. Delete Existing Secret Trigger automatic regeneration by deleting the current PostgreSQL certificate secret:

   kubectl delete secret vidb-postgres-instance-postgres-cert-secret -n vidb-external
   

   Note: If step b fails, delete any restored certificate requests.

   kubectl delete certificaterequest -n vidb-external -l velero.io/restore-name=vidb-restore-phase6
   

   c. Allow approximately 5 minutes for the automatic regeneration process to complete, during which the system will recreate the secret and rotate the certificate.

3. Clear the certificate alerts in VCF Operations and wait approximately one hour to see if they return.

Additional Information

Database backup failed for component vidb post VCF 9.1 Upgrade