Replacing VMware Live Site Recovery appliance's custom certificate with PKCS#12 fails

Products

• VMware Site Recovery Manager 8.x
• VMware Live Recovery

Issue/Introduction

Symptoms:

• When attempting to replace VMware Live Site Recovery appliance's certificate with a custom PKCS#12 file, the following error is seen:

  "The certificate is not in the correct format or has a different password"
  

Environment

VMware Site Recovery Manager 8.x

VMware Live Site Recovery 9.x

VMware vSphere Replication 8.x

VMware vSphere Replication 9.x

Cause

• From the /var/log/vmware/srm/vmware-dr.log it can be seen that the generate p12 file for the custom PCKS#12 certificate was using a legacy (not supported) algorithm:

  YYYY-MM-DDTHH:MM:SS.SSSZ error drconfig[01090] [SRM@6876 sub=DrConfigSslCertificateManager opID=########-####-####-####-############-installCertificate] Error while processing pkcs string 'N2Dr6Crypto20Pkcs12ParseExceptionE Crypto Exception: Cannot parse PKCS12
--> Reasons:
--> 400614AF717F0000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto/evp/evp_fetch.c:373:Global default library context, Algorithm (RC2-40-CBC : 0), Properties ()

• The p12 file is created with legacy (not supported) algorithm RC2-40-CBC.

• If the above error snippet is not visible in the logs, then either the password used for the p12 file is invalid or the openssl tool used to generate the p12 file is of an older version.

Resolution

 

To resolve this issue the below can be performed:

• Generate the p12 file for the custom PKCS#12 certificate by adding the following options to the openssl command ensure a supported algorithm is used: -keypbe aes-256-cbc -certpbe aes-256-cbc
  
  Example: openssl pkcs12 -export -in <protected-vr.cer> -inkey <protected-vr.key> -name "<vrprotected>" -passout pass:<password> -out <protected-vr.p12> -keypbe aes-256-cbc -certpbe aes-256-cbc
  
  Where (replace the below placeholders with the actual files/password/name):
  <protected-vr.cer>  ---> The Signed certificate file
  <protected-vr.key>  ---> The file with the private key
  <vrprotected>            ---> The friendly name for the certificate and private key
  <password>                  ---> The password to import the certificate with.
  <protected-vr.p12>  ---> The output file which will contain the certificate and private key.

 

If an older version of openssl is being used, it may give an error stating that the above algorithms are not available. In that case, either download the latest version of openssl or use the openssl tool available on the VLSR / VR appliance.

Additional Information

Configuring CA signed certificates for vSphere Replication or SRM based on Photon OS through Command line.