VMware Communities
rasmussj
Contributor
Contributor

VM Fusion can't complete TLS handshake on MACOS

I've been using Fusion for years without issue. Recently I've been unable to connect to my VMs via https:// on chrome and other browsers on MACOS Catalina 10.15.7

I've upgraded to a new V12 license without change.

I Can retrieve VM Appliance Certs from Browser
Certs are in KeyStore and are Trusted and pass KeyStore Evaluate' tool as Success/Good

SSH and TELNET also fail through I can SCP from the VM using the Fusion console.
SSH Terminates with

kex_exchange_identification: read: Connection reset by peer
Connection reset by 192.168.1.110 port 22

In order to validate any possible VM issues, I've exported a known good ESXi 6.5 hosted VM to my local V12 Fusion. And made only IP changes. Again I can't connect.

using openssl s_client -connect <ip>:<port>, I'm able to retrieve cert and ca information as well as connection details such as:

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: xxxxxx
Session-ID-ctx:
Master-Key: xxxxxx
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1620161053
Timeout : 7200 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
Extended master secret: yes

 

I believe my testing is showing these problems to be specific to Fusion and not the VMs hosted on it.

 

Wondering if others on MACOS have also experienced this.

John

 

 

0 Kudos
8 Replies
wila
Immortal
Immortal

Hi,

Sorry, what is your guest OS and what is your host OS?

Do you mean you can't connect to ANY https website in chrome, or is it specific for some appliances that you run?

Not sure what the openssl output is supposed to say? Are you getting this from a normal cert like google dot com and it comes back as a self signed cert or is it showing that "it works with openssl, but not with chrome?"

FWIW, no this is not something that has been reported by others.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
rasmussj
Contributor
Contributor

Hi Wil thanks for responding

My Macbook is Catalina 10.15.7. My VM Fusion is Professional Version 12.1.1 (17801503). I'm testing with Chrome  90.0.4430.93 (Official Build) (x86_64). I've also tested with Safari Version 14.0.3 (15610.4.3.1.7, 15610) and Firefox 78.10.0esr (64-bit).

I have multiple VMs hosted on my Fusion. Pervious VMs that have worked for many months. Along with new ones I've hosted including a 'known good' VM that I exported form ESXi 6.5 which I can access over HTTPS://<esxi65:ip> using that same test environment. And which I am not able to access using HTTPS://<fusionv12:ip> receiving ERR_CONNECTION_RESET instead.

Using Chrome developer tools, I see warning (net::ERR_CERT_COMMON_NAME_INVALID). Just as I do with the ESXi 6.5 hosted 'known good' VM and to which I'm able to make successful HTTPS:// connection via Chrome.

The openssl output is intended to demonstrate that I can make the TLSv1.2 connection to the VM Fusion VMs. And that I'm able to get the Server's certificate, which I'm able to add to the Macbook's KeyChain and Trust.

And yes I'm able to browse non VM Fusion hosted hosts just fine.

A summary might be; I can make a successful connection with openssl and curl (using -k), but not with Browsers or SSH.

Thanks

John

 

0 Kudos
wila
Immortal
Immortal

John,

So in recap, you're using the browsers at your host OS to connect to VMs on your VMware Fusion?

I was confused as initially I read it as that you were having issues using a browser from within one of your VMs..

The error CERT_COMMON_NAME_INVALID means that you are not connecting to the hostname for which the VM has a certificate.

eg. If you create a certificate for example.com, but you then connect to it via httpx://10.10.10.1 instead of httpx://example.com that you will see the above error. The name has to match the certificate for which it was created. If you created a cert for an IP address then that IP address cannot change. You will have to generate a new certificate.

Please note that I write httpx instead of https to not trigger the antispam filters on this forum.

You might be well aware about the above, but that's basically what the error is about.

With openSSL you can test for the common name like this:

openssl s_client -showcerts -servername example.com -connect example.com:443

Another way to test the certificate is using curl:

curl -L -v -s https://www.example.com 1>/dev/null

SSH normally throws an error about that the IP has changed and not just "disconnect", but that depends on the configuration and IIRC it normally only asks once with a Yes/No question.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
rasmussj
Contributor
Contributor

Wil

Yes understood. But again this is the Exact same cert on the ESXi 6.5 host and the VM Fusion VM. Signed by a CA which is trusted in the keychain


When I use the IP with the ESXi 6.5 host I can "accept the risk" and proceed (this is a test environment).
When I use the IP with the VMF host when I "accept the risk" then I get the ERR_CONNECTION_RESET

I can create create an /etc/hosts entry to match the certificates common name of the cert

When I connect with the ESXi 6.5 host using the 'common-name' I can connect
When I connect with the VMF host using the 'common-name' again I get the ERR_CONNECTION_RESET

I mentioned that I can connect to the VMF host using curl
But I will get several "curl: (35) OpenSSL SSL_connect: Connection reset by peer" before I am able to connect
And subsequent requests are also more likely to fail then succeed 

The same is true for the browser. While using developer tools, there are many ERR_CONNECTION_RESET before I can see Security Tab details about the cert.

 

John

 

0 Kudos
wila
Immortal
Immortal

John,

Gotcha, the connection reset is peculiar.

A few more questions.

Are you running a host based firewall on your mac?
Like Little Snitch, or Lulu or something else?

Just wondering if there's a possibility of something else that can influence the connection.

Another detail that I'm missing is if your VM's are using a bridged, NAT or host typed network configuration.

Seeing a vmware.log file from one of those VM's might also help as it helps answering more questions.

--
Wil

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
rasmussj
Contributor
Contributor

Wil

Thanks again for following this ...

The only Firewall I have is the default macos Firewall. I tried turning it off. No change

I'm using a Bridged network for all my VMs

I shutdown VMF and restarted it and the VM.

After making several Chrome requests to 192.168.1.111 (the VM), I'm attaching the vmware.log from the client 192.168.1.133

Cheers

 

John

 

0 Kudos
wila
Immortal
Immortal

Hi,

A few remarks.

The virtual hardware of the VM is version 10, which is very very old, I would suggest to switch it to a more recent version.

I also note that the VM has 4 vCPU's on a host which has only 4 physical cores (threads don't count). This means that it is likely that the host runs out of resources and as such your network resources might not be sufficient. The virtual network adapter uses CPU in order to route packets. So I suggest to drop the VM to use 2 vCPUs and see if that helps, if only for isolating the lack of available resources as a potential issue.

I also see that the guest OS is set as "Other-64" which is an odd choice and strongly recommend to have the guest OS type match the actual guest OS more closely. You never answered my question on what guest OS is running so I cannot make recommendations on that.

The network card is set to vmxnet3. That normally is the best choice, but it depends entirely on the guest OS used... you could try to change it to an e1000e type NIC and see if that helps.

--
Wil

 

| Author of Vimalin. The virtual machine Backup app for VMware Fusion, VMware Workstation and Player |
| More info at vimalin.com | Twitter @wilva
0 Kudos
rasmussj
Contributor
Contributor

Hi Wil

I've made progress on this issue.

The problem seems to have been ip conflicts or routing issues on the local 192 network.

I created a new custom network configuration using dhcp rather than static ip assignment and I'm now able to access the VMs via Browsers and SSH.

I have more investigation to do to fully understand why the previously functioning statically assigned IPs were no longer working.

Thanks very much for your assistance.

John

0 Kudos