Hello,
A month ago I clicked "Refresh with vCenter certificate" in vCenter -> Administration -> Certificate Management for the STS_CERT/Actions drop down. This was probably a bad idea since then the automatic backup configured in vcsa:5480 has not run, and no indication in the :5480 gui that it has failed either.
The STS Refresh was made because I was reconfiguring the certificate management with our on CA, but was probably unecessary to refresh it.
Anyhow, digging through the logs in /var/log/vmware/applmgmt I found these lines which gets logged when the backup is executed:
vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.
2022-04-25T00:00:02 AM CEST [2211]ERROR:vmware.appliance.vapi.auth:Could not parse HOK Token
Traceback (most recent call last):
File "/usr/lib/applmgmt/vapi/py/vmware/appliance/vapi/auth.py", line 243, in authenticate
username = token.username
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 486, in username
return self.get_name_id().value
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 939, in get_name_id
'//saml2:Subject/saml2:NameID', self.reference)
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 477, in reference
self.validate()
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 1169, in validate
reference = super(HolderOfKeyToken, self).validate()
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 505, in validate
signing_chain = self.validate_certificate()
File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 685, in validate_certificate
'One or more certificates cannot be verified.')
vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.
I've searched around in the KB's and all I can find are solutions for dealing with expired STS certs, which is not the case for me.
The KB https://kb.vmware.com/s/article/76448 seems to describe the symptoms accuratly, but the suggested Resolution does not seem to apply since I cannot see any stale or invalid certificate chains in Administration -> Certificates -> Certificate Management
Do you guys have any suggestions what steps to take from here to get out of this situation ? Manual backups works fine, and I've also tried "turning it off and on again".
With kind regards,
Martin
Accepted Solutions
As suspected you have 2 TrustedCertChain for sts .
Did you use the latest fixsts script from https://kb.vmware.com/s/article/76719. As this issue was fixed as I recall with script.
Download jxplorer from https://kb.vmware.com/s/article/2146046 . Connect and check as below . In my lab I have one but you should have 2 .
Take snapshot and delete TrustedCertChain-2 and reboot vCSA and check please .
As suspected you have 2 TrustedCertChain for sts .
Did you use the latest fixsts script from https://kb.vmware.com/s/article/76719. As this issue was fixed as I recall with script.
Download jxplorer from https://kb.vmware.com/s/article/2146046 . Connect and check as below . In my lab I have one but you should have 2 .
Take snapshot and delete TrustedCertChain-2 and reboot vCSA and check please .