Unable to update VCG database and Tool update on SHD getting SSL error

[lkrish]

Unable to update VCG database and Tool update on SHD getting SSL error.

Able to access URL through command line without certificate check but with certificate check it is failing.

[araikwar]

Could you please share the SHD support bundle? You can email the zipped bundle to shd-support@vmware.com along with description about the problem.

[lkrish]

Support bundle has been uploaded on VMware sftp site on SR 23442806706 case due to size restrictions on mail. Please review and let us know.

[araikwar]

Hi lkish,

Thanks for sharing SR details, mean while I would suggest you to try one workaround.

You need to update /etc/systemd/network/10-static-en.network file and mention DNS search domains, for example.

If you DNS server can resolve a.x.local and b.y.local domains, you can mention below line in 10-static-en.network file

Domains=a.x.local b.y.local

and restart SHD appliance.

Please try VCG update again once SHD appliance is restarted and share the results.

Thanks

Ashish

[lkrish]

Updated DNS search domains but still SSL connection issue.

[araikwar]

Hi Ikrish,

SHD team has a look on support bundle you shared. As per team, it seems like you are using MITM proxy which is handling SSL termination. You need to update SHD with proxy certificate. Please follow steps documented at Configuration for Proxies acting as MITM (Man-In-The-Middle)

Thanks

Ashish

[lkrish]

We don’t use any proxy settings.

[araikwar]

Hi lkrish,

From logs we can see there is some self signed certificate in the certificate chain, usually this happens only if there is some MITM proxy configured.

www.vmware.com is a public sight you should be able to connect to it over SSL from with in SHD VM.

Please try hitting www.vmware.com from within SHD VM using wget or curl and update the results. Execute below command and share the results

wget https://www.vmware.com/resources/compatibility/search.php

Thanks

Ashish

[araikwar]

Hi lkrish,

I hope the issue was resolved as per our discussion on emails.

Could you please update thread with fix and mark it as resolved?

Thanks

Ashish