[ovirt-users] Re: certification expires: PKIX path validation failed

Nathanaël Blanchet <blanchet(a)abes.fr&gt; writes: > Hi, > > Some of my hosts came into a non responsive state since there > certicate had expired: > > VDSM palomo command Get Host Capabilities failed: PKIX path validation > failed: java.security.cert.CertPathValidatorException: validity check > failed > > |openssl x509 -noout -enddate -in /etc/pki/vdsm/certs/vdsmcert.pem > palomo notAfter=Apr 6 11:09:05 2022 GMT | > > The recommanded path to update certificates is to put hosts into > maintenance and enroll certificates. > But I can't anymore live migrate vms since the certificate is expired: > > 2022-04-13 10:34:12,022+0200 ERROR (migsrc/bf0f7628) [virt.vm] > (vmId='bf0f7628-d70b-47a4-8569-5430e178f429') [SSL: > CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897) > (migration:331) > > > So is there a way to disable tls to migrate these vms so as to put the > host into maintenance? Do you use encrypted migrations? I think the client certificate is verified only with encrypted migrations. You can disable encrypted migrations in the web UI among other migration settings in cluster or VM settings. If it fails also with non-encrypted migrations, *maybe* removing the client certificate could help. If disabling encrypted migrations is not possible, you can try to set migrate_tls_x509_verify option in /etc/libvirt/qemu.conf on the destination host to 0 (libvirt restart may be needed to apply the changed setting). I guess there could be also a way to run the Ansible role for updating the certificates manually (not recommended etc. etc. but perhaps still useful in this case) without putting the host into the maintenance. Just a speculation, I don’t know whether it’s actually possible and how to do it if it is. Regards, Milan > No possibility of migration would imply to stop production vms, this > is what we absolutely don't want! > > Any help much appreciated. > > ||