Error code LCMVRLICONFIG40004 with the message "InvalidKeySpecException: key spec not recognized" when performing inventory sync in Aria Suite Lifecycle Manager Inventory Sync for Aria Operations for Logs & Networks

Products

• VMware Aria Suite

Issue/Introduction

The issue is not specific to Aria Operations for Logs &  Networks and can affect other products integrated with Aria Suite Lifecycle Manager

• Aria Suite Lifecycle Manager Inventory Sync for aria operations for networks fails with Error Code : 'LCMVRNICONFIG90115'
• The /var/log/vrlcm/vmware_vrlcm.log file contains an InvalidKeySpecException error similar to:

2024-02-09 07:36:44.795 ERROR [pool-3-thread-1] c.v.v.l.p.c.v.t.i.ImportVrniEnvTask - -- Error occured while connecting as consoleuser, could be because of console password. Injecting task failure event. Error Code : 'LCMVRLICONFIG40004', Retry : 'true', Causing Properties : '{ CAUSE :: vrliHostName === }' com.vmware.vrealize.lcm.vrli.exception.VrliInvalidHostException: Cannot execute ssh commands. Exception encountered : Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized Invalid hostname provided for VMware Aria Operations for Logs import. Please check the hostname and retry again. java.lang.RuntimeException: Cannot execute ssh commands. Exception encountered : Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized

JSchException :: com.jcraft.jsch.JSchException: Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized
 

• Aria Suite Lifecycle Manager Inventory Sync for aria operations for Logs fails with Error Code : 'LCMVRLICONFIG40004 '
  
  
  
  
• The /var/log/vrlcm/vmware_vrlcm.log file contains an InvalidKeySpecException error similar to:
  
  com.vmware.vrealize.lcm.vrli.exception.VrliInvalidHostException: Cannot execute ssh commands. Exception encountered : Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized  com.vmware.vrealize.lcm.plugin.vrli.VrliImportEnvironmentTask.execute(VrliImportEnvironmentTask.java:342) at com.vmware.vrealize.lcm.platform.automata.service.Task.retry(Task.java:158) at com.vmware.vrealize.lcm.automata.core.TaskThread.run(TaskThread.java:60) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.base/java.lang.Thread.run(Unknown Source)
  
  
  

Environment

VMware Aria Suite Lifecycle 8.14.x and later Versions

Cause

This is a known issue reported in the VMware Aria Suite Lifecycle 8.14 Patch 1 Release Notes. See Product Deployment and Day-2 Operations failure due to SHA1 weak ciphers/algorithms removal from VMware Aria Suite Lifecycle

After applying VMware Aria Suite Lifecycle 8.14 Patch 1, you may encounter deployment and day-2 operation failures, attributed to the elimination of weak algorithms in Suite Lifecycle. To prevent such issues, it is recommended to either turn on FIPS in VMware Aria Suite Lifecycle or implement the specified workarounds on other VMware Aria Products, as outlined in the article Steps for Removing SHA1 weak Algorithms/Ciphers from all VMware Aria Products.

Sample Exception:

InvalidKeySpecException: key spec not recognized.

Resolution

Follow the article Steps for Removing SHA1 weak Algorithms/Ciphers from all VMware Aria Products or alternatively follow the steps indicated in the workaround section.

Workaround:

Prerequisites

• Validate you have valid backups or temporary snapshots of VMware Aria Suite Lifecycle before proceeding.

Procedure

1. Log in to VMware Aria Suite Lifecycle.
2. Navigate to Lifecycle Operations > Settings > System Details.
3. Check the option Enabled on FIPS Mode Compliance and then click on UPDATE (this will restart VMware Aria Suite Lifecycle services).                                                                                 
4. After the services restart, retry the VMware Automation day 2 action.
5. If you have a need to leave FIPs off, then you can revert the changes by disabling the FIPs Mode Compliance located at Lifecycle Operations > Settings > System Details and then click on UPDATE to restart the services.

Note: This can cause subsequent upgrades and day 2 actions to fail again, and it will need to be enabled again to run them. This can be avoided by updating the ciphers as per the workaround in Steps for removing weak SHA1 algorithms and ciphers from VMware Aria Products