Welcome to the Linux Foundation Forum!

VID X509 Certification expiration problem

huntingweb
huntingweb Posts: 17
edited March 2022 in LFS263 Class Forum - Discontinued

I got following error in VID portal:
Status:Error: Failed to get service models from SDC.

and saw certification expired message in the vid pod log.

How to process?

Regards,
David Xie

19:56:43.659 [https-openssl-nio-8443-exec-7] ERROR org.onap.vid.aai.AaiClient - Failed to get service models by distribution status
org.onap.vid.aai.ExceptionWithRequestInfo: Exception while handling PUT https://aai.onap:8443/aai/v19/query?format=resource: javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed

...
`
Caused by: java.security.cert.CertPathValidatorException: validity check failed
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
at
...
Caused by: java.security.cert.CertificateExpiredException: NotAfter: Sat Jan 22 01:37:19 UTC 2022
at java.base/sun.security.x509.CertificateValidity.valid(CertificateValidity.java:277)
at java.base/sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:675)
at java.base/sun.security.provider.certpath.BasicChecker.verifyValidity(BasicChecker.java:190)
at java.base/sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:144)
at java.base/sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)
... 125 common frames omitted

`

Answers

  • huntingweb
    huntingweb Posts: 17

    Actually the issue comed from AAI pod
    The certificate in file /etc/ssl/private/aai.pem had been expired

    Any solution or quick work around for this?

  • raghuramg
    raghuramg Posts: 73

    Hi @huntingweb,
    Could you please add my Public key to your anod-master VM? I would like to connect a taka a look at your setup. Please share the Public IP of anod-master VM.

    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCgqX75jJADWy+XqDGMKNrX7u7xJkB5lFKXrkglEmA+xt/pxt8HiBSIlQW7FB+8kiVfhmGjO6d4K8KwjTulvCPZLYnev0rhKXpIbDo7OcpgLnqhNpPJwpKMHW6LAXptmLQ5koPQQpXLU9Tv1T9hT39Vv2nOw35YHKdFRL+WBMW1cm75FPLUpfFXzT5ZIA3mOfvOh3OkP9ViOuCGODVVt7FRcAEq0trGRe0yJq9Gs9+1wmnHNXABrUMJkKjCt0x5SELDosRJYZn8JbUI3zlrxpnSqUadBvoyDegZRDa6MWASyi0DRAgpadSc3CmJVg0DW4zMO0I0uoHWen8HQTsWBRWL raghuram@raghuram-Latitude-7410

  • huntingweb
    huntingweb Posts: 17

    Here is the detail of problem:

    Lab is currently using guilin branch.

    Under oom/kubernetes/aai/resources/config/haproxy/
    File aai.pem contains a certification like following.

    `
    -----BEGIN CERTIFICATE-----
    MIIFKzCCBBOgAwIBAgIIOB41ln9crqQwDQYJKoZIhvcNAQELBQAwRzELMAkGA1UE
    BhMCVVMxDTALBgNVBAoMBE9OQVAxDjAMBgNVBAsMBU9TQUFGMRkwFwYDVQQDDBBp
    bnRlcm1lZGlhdGVDQV85MB4XDTIxMDEyMjAxMzcxOVoXDTIyMDEyMjAxMzcxOVow
    WTEMMAoGA1UEAwwDYWFpMR0wGwYDVQQLDBRhYWlAYWFpLm9uYXAub3JnOkRFVjEO
    MAwGA1UECwwFT1NBQUYxDTALBgNVBAoMBE9OQVAxCzAJBgNVBAYTAlVTMIIBIjAN
    BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtHUOwrGkw8fjOyb/wKNb8BDJeAmP
    mtFxCU3CaoBlgI0kn2XIg1IlK2g1TjiM81z6hrcfUt3fPT3EiLTmxMyHtJJpQLQZ
    WbrWR+oHugiPxXqRCINNu2KmlObhVl+zQundSwRz9ecX2wgws7w6rT4keJP4A9qR
    4ueBtHvPHbebt6bXbD9G79ARPqhtCRmrJnYvOyo+ImvwyRtqcRcBRSEZ1VUkP5Ol
    2/8c4vRl5owXNA2PT7NMdiZHEWKc/sWN+58VNONLK4ylL8YPF3hbxDbPx90dS6+E
    dT5ZKtjzTYjsbMWhBOyMdrcQN/07vSTPzvYaHN5uf1F8Yl/kTz8HRNTr1wIDAQAB
    o4ICBzCCAgMwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCBeAwIAYDVR0lAQH/BBYw
    FAYIKwYBBQUHAwEGCCsGAQUFBwMCMFQGA1UdIwRNMEuAFIH3mVsQuciM3vNSXupO
    aaBDPqzdoTCkLjAsMQ4wDAYDVQQLDAVPU0FBRjENMAsGA1UECgwET05BUDELMAkG
    A1UEBhMCVVOCAQcwHQYDVR0OBBYEFO3zKoHszn7OiYywPQ5RD+mVC5UPMIIBTQYD
    VR0RBIIBRDCCAUCBH21hcmsuZC5tYW5hZ2VyQHBlb3BsZS5vc2FhZi5jb22CA2Fh
    aYIUYWFpLXNlYXJjaC1kYXRhLm9uYXCCEmFhaS1zcGFya3ktYmUub25hcIIbYWFp
    LmFwaS5zaW1wbGVkZW1vLm9uYXAub3JngiVhYWkuZWxhc3RpY3NlYXJjaC5zaW1w
    bGVkZW1vLm9uYXAub3JngiVhYWkuZ3JlbWxpbnNlcnZlci5zaW1wbGVkZW1vLm9u
    YXAub3Jngh1hYWkuaGJhc2Uuc2ltcGxlZGVtby5vbmFwLm9yZ4IIYWFpLm9uYXCC
    JWFhaS5zZWFyY2hzZXJ2aWNlLnNpbXBsZWRlbW8ub25hcC5vcmeCF2FhaS5zaW1w
    bGVkZW1vLm9uYXAub3JnghphYWkudWkuc2ltcGxlZGVtby5vbmFwLm9yZzANBgkq
    hkiG9w0BAQsFAAOCAQEAPXR5X88JkmrJ3fwt/fwngTVbooacoItx8ZQyabcsn7q6
    KLw8iyF8Bq/iXXeOvZLzkM1EFCTVHd5VcjfMgVNXhKtcZVJqawF+Kj4fmCQXgml+
    TbxEz+FDze38Y9KEKT8B+bMDca+0bmZvC6QwajBfUSULrzRCUDc2oLM7Jt4+SwQS
    Vn+1Jutp+pD8GeZsLCr8YkuZxczevm/0Rub0lBLiTEDV0DbtyT8YP4qZbBLXKLLf
    w4mF0zGY+5ECq5mHcHfw3rHw3JlBgNs9kBllB/wBJ3OztchUd9/d30zw3ac+FzxI
    oIZbF7liT8mqgGwPI5HGTpq/oTZWEkhPfxBFlmp3+g==
    -----END CERTIFICATE-----

    `

    Using keytool -printcert, you can confirm it is
    Valid from: Thu Jan 21 20:37:19 EST 2021 until: Fri Jan 21 20:37:19 EST 2022

    I just delete my domain. If you still need it, please let me know.

  • raghuramg
    raghuramg Posts: 73

    Hi @huntingweb,
    Okay. No issues. I will create an ONAP Guilin setup in my environment. I will debug this certificate issue and will get back to you once it is fixed. Thanks.

  • huntingweb
    huntingweb Posts: 17

    @raghuramg

    Do you have any solution for this?
    Here is discussion thread
    https://lists.onap.org/g/onap-discuss/topic/aai_certificate_for_earlier/88672513?p=,,,20,0,0,0::recentpostdate/sticky,,,20,2,20,88672513,previd=1644301599745701982,nextid=1642601106105774381&previd=1644301599745701982&nextid=1642601106105774381

    It suggests upgrading to Istanbul release which will automatically generate certificate.

    I had been stuck in LAB for 2 weeks. Please help.

  • raghuramg
    raghuramg Posts: 73

    Hi @huntingweb,
    We have a workaround for the AAI certificate expiry problem. I will have to test it in my internal setup to validate and confirm. if those steps work, I will share the steps with you. if not, we'll have to think of upgrading it to I release.

  • huntingweb
    huntingweb Posts: 17

    @raghuramg said:
    Hi @huntingweb,
    We have a workaround for the AAI certificate expiry problem. I will have to test it in my internal setup to validate and confirm. if those steps work, I will share the steps with you. if not, we'll have to think of upgrading it to I release.

    Hi @raghuramg
    Do you have any update on this?

    Regards,

  • raghuramg
    raghuramg Posts: 73

    Hi @huntingweb,
    This is still working in progress. We are working towards fixing this issue.

  • raghuramg
    raghuramg Posts: 73

    Hi @huntingweb,

    There are two independent failures in the ONAP labs.

    1) OpenStack install failures: This was due to a CentOS expiration. We have fixed this and created an Ubuntu image, which will be published in a day.

    2) ONAP Guilin release certificate expirations: We are determining whether it is easier to update the certificate or to upgrade the labs to Istanbul release. It may take us a few weeks to upgrade all the labs to Istanbul (and update the documentation). But if you need them sooner, we can install the Istanbul release for you (on your GCP VM, if you can give access to us) and then support you with the labs in Istanbul. Please let us know if you prefer this approach.

  • huntingweb
    huntingweb Posts: 17

    Hi @raghuramg

    I appreciate your help. Sent you message regarding how to give you the access. Please check.

  • raghuramg
    raghuramg Posts: 73

    HI @huntingweb.
    I have replied to your message. Please check. Thanks.

Categories

Upcoming Training