...
- API has to be invoked multiple times to upload the certificates and has to be done in order following from root cert, 0 or more intermediate certs followed by server cert and private key.
- Uploading root certificate and the server certificates are mandatory steps.
- Uploading intermediate certificates(s) is optional.
- Self-signed certificates are not supported.
- Reverting back to Realhostip.com or the last certificate is not supported.
...
mysql> desc keystore;
+---------------+---------------------+------+-----+---------+----------------+
| Field | Type | Null | Key | Default | Extra |
+---------------+---------------------+------+-----+---------+----------------+
| id | bigint(20) unsigned | NO | PRI | NULL | auto_increment |
| name | varchar(64) | NO | UNI | NULL | |
| certificate | text | NO | | NULL | |
| key | text | YES | | NULL | |
| domain_suffix | varchar(256) | NO | | NULL | |
| seq | int(11) | YES | | NULL | |
+---------------+---------------------+------+-----+---------+----------------+
SSVM
- SSVM
java keystore has the right certificate (keytool -list -keystore /usr/local/cloud/systemvm/certs/realhostip.keystore -storepass vmops.com)- acts as a server for download template/volume/iso operations and during copyTemplate if it is in the source zone. It uses an Apache webserver when acting as server.
- Apache server should have
Apache server has - It acts as a client during copyTemplate operation if it is in the destination zone. SSVM uses a Java client when acting as client.
- SSVM has a java keystore which should have the root certificate Use the command below to list all certs in the keystore
keytool -list -keystore /usr/local/cloud/systemvm/certs/realhostip.keystore -storepass vmops.com
- When UploadCustomCertificate is invoked for server cert and private key the ssvm is rebooted and as part of ssvm agent connect with MS, a command called SecStorageSetupCommand containing the certs is sent to ssvm. which
CPVM
- CPVM acts as a server only and uses Java HTTP server
TroubleShooting
- Download urls point to the old domain.
- Reduce the expiration duration of the urls by changing global config extract.url.expiration.interval
- And change the frequency for cleanup thread through extract.url.cleanup.interval restart MS.
- Wait for the cleanup thread duration and try downloading again. See whether the url is deleted.
- CopyTemplate giving the exception - PKIX certification error
- Via browser or any client, check whether Apache Webserver for SSVM is sending the entire chain
- Check whether the realhostip.keystore (Java keystore) on SSVM has the root CA certificate : keytool -list -keystore realhostip.keystore -storepass vmops.com
- Download urls are not working.
- Via browser or any client, check whether Apache Webserver for SSVM is sending the entire chain
I don’t see the latest systemvm.iso being patched since the /usr/local/cloud/systemvm/config_ssl.sh on ssvm is still the old one
- I changed CPVM to work on HTTPS from HTTP, or vice-versa. It does not change.
- You may need to destroy and recreate your CPVM when switching between HTTP and HTTPS protocols
- Certificate encoding -
- Make sure you have correctly url encoded the certificates. To do this you can check cloud database and check the entries in keystore table and match them with the original certificates you had.
- Uploaded wrong certificate -
- In case you uploaded wrong certificates for root/intermediate, you can undo that by calling the api with same name and domainsuffix. In case you uploaded wrong server certificate upload the right one through the UI keeping the same domain suffix.
- Any other issues with ssvm -
- Check logs - Check MS logs (/var/log/cloudstack/management ) and ssvm logs (under /var/log/cloud/) to see if you can find any exceptions in programming the certificate.
- Destroy ssvm - If nothing is apparent from the logs try destroying ssvm as one of the last resorts. Try this in one of the zones and see if the new ssvm which comes up solves the issues.
- I have already uploaded certificate and chain in a prior CCP version. Am I all good?
- Unfortunately, no. You will need to re-upload the whole chain using the same API parameters (name, id etc.)