Skip to main content

 Embedded vRO Integration is broken after replacing certificate.

https://knowledge.broadcom.com/external/article?articleNumber=380251

Products

VMware Aria Suite

Issue/Introduction

Embedded VRO integration is not in healthy state after VRA certificate replacement

910001: Can not connect to Automation Orchestrator Server. org.springframework.web.reactive.function.client.WebClientRequestException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Environment

VMware vRealize Automation 8.x
VMware Aria Automation 8.x

Cause

Trust is broken between Aria Automation and vRealize Orchestrator when the Orchestrator certificate is replaced.

Resolution

To workaround this issue you need to update the Integration endpoint data using API 

  1. Obtain a Bearer token following the article Generate Access_Token/Bearer_Token in VRA 8.x for API Authentication
    You will use this as b_token value in the below steps. 

  2. Get the certificate of VCO endpoint
    openssl s_client -connect <VRO_FQDN>:443 2> /dev/null | openssl x509 | awk 'NF {sub(/\r/, "");  printf "%s\\n",$0;}'

  3. Get the info and ID of the all Integrations
    curl -k "https://<VRAVIP>/iaas/api/integrations/?apiVersion=2021-07-15" -H "Authorization: Bearer b_token" | jq -r '.content[] | .id + "," + .name'

    Example: results:
    9dcd99ce-7103-4e75-9256-684bb6bf682b,embedded-ABX-onprem
    3b60be1a-ef4b-473b-9b83-1f09456a75fe,raas
    f826c2f3-565c-4918-93cb-67a2b9dbb180,gss support
    c25cf2bc-e7f9-4a99-a378-8a3a13446c21,embedded-VRO

  4. Get the info VRO endpoint details:
    curl -k "https://<VRAVIP>/iaas/api/integrations/c25cf2bc-e7f9-4a99-a378-8a3a13446c21?apiVersion=2021-07-15" -H "Authorization: Bearer b_token" | jq .

  5. Patch the endpoint using API
    curl -v -k -X PATCH "https://<VRAVIP>/iaas/api/integrations/c25cf2bc-e7f9-4a99-a378-8a3a13446c21?apiVersion=2021-07-15"  -H "Accept: application/json" -H 'Content-Type: application/json' -H "Authorization: Bearer b_token" --data-raw  '{"certificateInfo": {"certificate":"Certificate content captured step 2"}}'

    Body with just certificate:
    {
       "certificateInfo": {
          "certificate": "Certificate content captured step 2"
          }
     }

  6. When you apply certificate you validate check the Integration properties 

  7. After cert is applied, data collection is fine but you still see error: "910000: Error : Can not connect to the Automation Orchestrator Server...". To fix this error you must patch vCO Integration "vroUnresponsiveReason" property.

  8. Patch the endpoint using API
    curl -v -k -X PATCH "https://<VRAVIP>/iaas/api/integrations/c25cf2bc-e7f9-4a99-a378-8a3a13446c21?apiVersion=2021-07-15"  -H "Accept: application/json" -H 'Content-Type: application/json' -H "Authorization: Bearer b_token" --data-raw  '{"customProperties": {"vroUnresponsiveReason":"}}'

    Body with just certificate:
     {
         "customProperties": {
         "vroUnresponsiveReason":""}
     }

Comments

Post a Comment

Popular posts from this blog

Quick Guide to VCF Automation for VCD Administrators

  Quick Guide to VCF Automation for VCD Administrators VMware Cloud Foundation 9 (VCF 9) has been  released  and with it comes brand new Cloud Management Platform –  VCF Automation (VCFA)  which supercedes both Aria Automation and VMware Cloud Director (VCD). This blog post is intended for those people that know VCD quite well and want to understand how is VCFA similar or different to help them quickly orient in the new direction. It should be emphasized that VCFA is a new solution and not just rebranding of an old one. However it reuses a lot of components from its predecessors. The provider part of VCFA called Tenenat Manager is based on VCD code and the UI and APIs will be familiar to VCD admins, while the tenant part inherist a lot from Aria Automation and especially for VCD end-users will look brand new. Deployment and Architecture VCFA is generaly deployed from VCF Operations Fleet Management (former Aria Suite LCM embeded in VCF Ops. Fleet Management...
Post a Comment
Read more
  Issue with Aria Automation Custom form Multi Value Picker and Data Grid https://knowledge.broadcom.com/external/article?articleNumber=345960 Products VMware Aria Suite Issue/Introduction Symptoms: Getting  error " Expected Type String but was Object ", w hen trying to use Complex Types in MultiValue Picker on the Aria for Automation Custom Form. Environment VMware vRealize Automation 8.x Cause This issue has been identified where the problem appears when a single column Multi Value Picker or Data Grid is used. Resolution This is a known issue. There is a workaround.  Workaround: As a workaround, try adding one empty column in the Multivalue picker without filling the options. So we can add one more column without filling the value which will be hidden(there is a button in the designer page that will hide the column). This way the end user will receive the same view.  
Post a Comment
Read more
  "Cloud zone insights not available yet, please check after some time" message on Aria Automation https://knowledge.broadcom.com/external/article?articleNumber=314894 Products VMware Aria Suite Issue/Introduction Symptoms: The certificate for Aria operations has been replaced since it was initially added to Aria Automation as an integration. When accessing the Insights pane under  Cloud Assembly  ->  Infrastructure  ->  Cloud Zone  ->  Insights  the following message is displayed:   "Cloud zone insights not available yet, please check after some time." The  /var/log/services-logs/prelude/hcmp-service-app/file-logs/hcmp-service-app.log  file contains ssl errors similar to:   2022-08-25T20:06:43.989Z ERROR hcmp-service [host='hcmp-service-app-xxxxxxx-xxxx' thread='Thread-56' user='' org='<org_id>' trace='<trace_id>' parent='<parent_id>' span='<span_id>'] c.v.a.h.a.common.AlertEnu...
Post a Comment
Read more