VID X509 Certification expiration problem

huntingweb

I got following error in VID portal:
Status:Error: Failed to get service models from SDC.

and saw certification expired message in the vid pod log.

How to process?

Regards,
David Xie

---

19:56:43.659 [https-openssl-nio-8443-exec-7] ERROR org.onap.vid.aai.AaiClient - Failed to get service models by distribution status
org.onap.vid.aai.ExceptionWithRequestInfo: Exception while handling PUT https://aai.onap:8443/aai/v19/query?format=resource: javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed

...
`
Caused by: java.security.cert.CertPathValidatorException: validity check failed
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
at
...
Caused by: java.security.cert.CertificateExpiredException: NotAfter: Sat Jan 22 01:37:19 UTC 2022
at java.base/sun.security.x509.CertificateValidity.valid(CertificateValidity.java:277)
at java.base/sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:675)
at java.base/sun.security.provider.certpath.BasicChecker.verifyValidity(BasicChecker.java:190)
at java.base/sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144)
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
... 125 common frames omitted

`

huntingweb

Actually the issue comed from AAI pod
The certificate in file /etc/ssl/private/aai.pem had been expired

Any solution or quick work around for this?

raghuramg

Hi @huntingweb,
Could you please add my Public key to your anod-master VM? I would like to connect a taka a look at your setup. Please share the Public IP of anod-master VM.

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgqX75jJADWy+XqDGMKNrX7u7xJkB5lFKXrkglEmA+xt/pxt8HiBSIlQW7FB+8kiVfhmGjO6d4K8KwjTulvCPZLYnev0rhKXpIbDo7OcpgLnqhNpPJwpKMHW6LAXptmLQ5koPQQpXLU9Tv1T9hT39Vv2nOw35YHKdFRL+WBMW1cm75FPLUpfFXzT5ZIA3mOfvOh3OkP9ViOuCGODVVt7FRcAEq0trGRe0yJq9Gs9+1wmnHNXABrUMJkKjCt0x5SELDosRJYZn8JbUI3zlrxpnSqUadBvoyDegZRDa6MWASyi0DRAgpadSc3CmJVg0DW4zMO0I0uoHWen8HQTsWBRWL raghuram@raghuram-Latitude-7410

huntingweb

Here is the detail of problem:

Lab is currently using guilin branch.

Under oom/kubernetes/aai/resources/config/haproxy/
File aai.pem contains a certification like following.

`
-----BEGIN CERTIFICATE-----
MIIFKzCCBBOgAwIBAgIIOB41ln9crqQwDQYJKoZIhvcNAQELBQAwRzELMAkGA1UE
BhMCVVMxDTALBgNVBAoMBE9OQVAxDjAMBgNVBAsMBU9TQUFGMRkwFwYDVQQDDBBp
bnRlcm1lZGlhdGVDQV85MB4XDTIxMDEyMjAxMzcxOVoXDTIyMDEyMjAxMzcxOVow
WTEMMAoGA1UEAwwDYWFpMR0wGwYDVQQLDBRhYWlAYWFpLm9uYXAub3JnOkRFVjEO
MAwGA1UECwwFT1NBQUYxDTALBgNVBAoMBE9OQVAxCzAJBgNVBAYTAlVTMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtHUOwrGkw8fjOyb/wKNb8BDJeAmP
mtFxCU3CaoBlgI0kn2XIg1IlK2g1TjiM81z6hrcfUt3fPT3EiLTmxMyHtJJpQLQZ
WbrWR+oHugiPxXqRCINNu2KmlObhVl+zQundSwRz9ecX2wgws7w6rT4keJP4A9qR
4ueBtHvPHbebt6bXbD9G79ARPqhtCRmrJnYvOyo+ImvwyRtqcRcBRSEZ1VUkP5Ol
2/8c4vRl5owXNA2PT7NMdiZHEWKc/sWN+58VNONLK4ylL8YPF3hbxDbPx90dS6+E
dT5ZKtjzTYjsbMWhBOyMdrcQN/07vSTPzvYaHN5uf1F8Yl/kTz8HRNTr1wIDAQAB
o4ICBzCCAgMwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBeAwIAYDVR0lAQH/BBYw
FAYIKwYBBQUHAwEGCCsGAQUFBwMCMFQGA1UdIwRNMEuAFIH3mVsQuciM3vNSXupO
aaBDPqzdoTCkLjAsMQ4wDAYDVQQLDAVPU0FBRjENMAsGA1UECgwET05BUDELMAkG
A1UEBhMCVVOCAQcwHQYDVR0OBBYEFO3zKoHszn7OiYywPQ5RD+mVC5UPMIIBTQYD
VR0RBIIBRDCCAUCBH21hcmsuZC5tYW5hZ2VyQHBlb3BsZS5vc2FhZi5jb22CA2Fh
aYIUYWFpLXNlYXJjaC1kYXRhLm9uYXCCEmFhaS1zcGFya3ktYmUub25hcIIbYWFp
LmFwaS5zaW1wbGVkZW1vLm9uYXAub3JngiVhYWkuZWxhc3RpY3NlYXJjaC5zaW1w
bGVkZW1vLm9uYXAub3JngiVhYWkuZ3JlbWxpbnNlcnZlci5zaW1wbGVkZW1vLm9u
YXAub3Jngh1hYWkuaGJhc2Uuc2ltcGxlZGVtby5vbmFwLm9yZ4IIYWFpLm9uYXCC
JWFhaS5zZWFyY2hzZXJ2aWNlLnNpbXBsZWRlbW8ub25hcC5vcmeCF2FhaS5zaW1w
bGVkZW1vLm9uYXAub3JnghphYWkudWkuc2ltcGxlZGVtby5vbmFwLm9yZzANBgkq
hkiG9w0BAQsFAAOCAQEAPXR5X88JkmrJ3fwt/fwngTVbooacoItx8ZQyabcsn7q6
KLw8iyF8Bq/iXXeOvZLzkM1EFCTVHd5VcjfMgVNXhKtcZVJqawF+Kj4fmCQXgml+
TbxEz+FDze38Y9KEKT8B+bMDca+0bmZvC6QwajBfUSULrzRCUDc2oLM7Jt4+SwQS
Vn+1Jutp+pD8GeZsLCr8YkuZxczevm/0Rub0lBLiTEDV0DbtyT8YP4qZbBLXKLLf
w4mF0zGY+5ECq5mHcHfw3rHw3JlBgNs9kBllB/wBJ3OztchUd9/d30zw3ac+FzxI
oIZbF7liT8mqgGwPI5HGTpq/oTZWEkhPfxBFlmp3+g==
-----END CERTIFICATE-----

`

Using keytool -printcert, you can confirm it is
Valid from: Thu Jan 21 20:37:19 EST 2021 until: Fri Jan 21 20:37:19 EST 2022

I just delete my domain. If you still need it, please let me know.

raghuramg

Hi @huntingweb,
Okay. No issues. I will create an ONAP Guilin setup in my environment. I will debug this certificate issue and will get back to you once it is fixed. Thanks.

huntingweb

@raghuramg

Do you have any solution for this?
Here is discussion thread
https://lists.onap.org/g/onap-discuss/topic/aai_certificate_for_earlier/88672513?p=,,,20,0,0,0::recentpostdate/sticky,,,20,2,20,88672513,previd=1644301599745701982,nextid=1642601106105774381&previd=1644301599745701982&nextid=1642601106105774381

It suggests upgrading to Istanbul release which will automatically generate certificate.

I had been stuck in LAB for 2 weeks. Please help.

raghuramg

Hi @huntingweb,
We have a workaround for the AAI certificate expiry problem. I will have to test it in my internal setup to validate and confirm. if those steps work, I will share the steps with you. if not, we'll have to think of upgrading it to I release.

huntingweb

@raghuramg said:
Hi @huntingweb,
We have a workaround for the AAI certificate expiry problem. I will have to test it in my internal setup to validate and confirm. if those steps work, I will share the steps with you. if not, we'll have to think of upgrading it to I release.

Hi @raghuramg
Do you have any update on this?

Regards,

raghuramg

Hi @huntingweb,
This is still working in progress. We are working towards fixing this issue.

raghuramg

Hi @huntingweb,

There are two independent failures in the ONAP labs.

1) OpenStack install failures: This was due to a CentOS expiration. We have fixed this and created an Ubuntu image, which will be published in a day.

2) ONAP Guilin release certificate expirations: We are determining whether it is easier to update the certificate or to upgrade the labs to Istanbul release. It may take us a few weeks to upgrade all the labs to Istanbul (and update the documentation). But if you need them sooner, we can install the Istanbul release for you (on your GCP VM, if you can give access to us) and then support you with the labs in Istanbul. Please let us know if you prefer this approach.

huntingweb

Hi @raghuramg

I appreciate your help. Sent you message regarding how to give you the access. Please check.

raghuramg

HI @huntingweb.
I have replied to your message. Please check. Thanks.