How to add/delete Custom CA Certificates to SDDC Manager and Common Services trust stores
book
Article ID: 316056
calendar_today
Updated On:
Products
VMware Cloud Foundation
Issue/Introduction
Symptoms:
If the custom CA root certificate is not published to the SDDC Manager truststores, then the subsequent errors might be evident:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
In SOS logs: 2020-03-26T11:04:28.661Z [ERROR restutil.py::get::128::_collect_https_esx_logsThread0] GET call failed for https://esxi-1.vcf.example.com/cgi-bin/vm-support.cgi due to HTTPSConnectionPool(host='esxi-1.vcf.example.com', port=443): Max retries exceeded with url: /cgi-bin/vm-support.cgi (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))
Note: This log excerpt is an example. Date, time, and environmental variables may vary depending on your environment.
Environment
Vmware Cloud Foundation 4.5.1
Resolution
The custom CA root certificate should be added to SDDC-Manager trust stores.
To add custom CA root certificate to SDDC Manager (versions prion to 4.1) trust store:
Note: Take a snapshot of the SDDC Manager VM prior to starting this process
Use a file transfer utility to copy the trusted certificate file to the /tmp directory on the SDDC Manager VM.
SSH to the SDDC Manager VM as the VCF user and then issue the su - command to switch to the root user.
Obtain the trusted certificates key by issuing the following command:
Replace <certificate file> with the full path to the certificate file that was uploaded in Step 1
Issue a command similar to the following to verify that the new trusted certificate has been added to the SDDC Manager trust store:
keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass <trust store key>
Note: Replace <trust store key> with the trusted certificates key value returned in Step 3 Issue the following command to restart the SDDC Manager services:
To delete a stale certificate in trust store : (Please reach out to GSS if you are not sure)
a. Take Snapshot of SDDC manager VM b. Find the alias of the duplicate cert by running this command keytool -list -v -keystore /etc/vmware/vcf/commonsvcs/trusted_certificates.store -storepass <trust store key> c.Delete the duplicate alias by running