[ovirt-users] Re: PKIX path validation failed: java.security.cert.CertPathValidatorException: validity check failed
Hello. I just encountered this myself last night. I found the solution on red hats
customer portal. It was suggested to run setup-engine once more, as it will renew the
self-signed certficates. It worked for me, though I'm running on oVirt 4.5.4-1.el8.
Remember to run this command on a oVirt NODE (not the engine):
hosted-engine --set-maintenance --mode=global
And the run the following command in you selfhosted engine:
engine-setup
I did not use the --offline switch. It renewed the certificates and all is good in my
case.
However, there is a case with your exact error on the Red Hat Customer Portal, even when
you have enabled global maintenance mode. See here:
https://access.redhat.com/solutions/2689961 (in case I'm not allowed to post links,
I'm sorry, let me know and I will remove it).
The root cause appears to be related to a check build into setup-engine to verify if the
hosted-engine is up. In your case it might be showing as down, causing this error message.
According to the Customer Portal this might happen when the environment was restored using
engine-backup from an old HE environment. So the HE VM which exist in the current
environment was the old HE VM with old UUID. It might need manual manipulation of the
database to make sure tthe UUID of the new engine is installed in the database, which the
results in the correct up/down state when the setup-engine check. The article seems to
suggest that removing the UUID of the old engine would be sufficient to resolve the
problems.
The following SQL statements were supplied to verify the state of the engine in the
database and might give you a clue as to what to change in the database:
SELECT vm_guid, run_on_vds FROM vms WHERE vm_name ='HostedEngine';
SELECT vds_id, ha_global_maintenance FROM vds_statistics WHERE vds_id =
'vds-uuid';
I guess in your case 2 entries appear on the first statement, both the new and old
HostedEngine VM. Removing the old one, would probably fix your issue.
I have no idea if you did restore an eenvironment at some point, or if you are dealing
with some other corruption?
I hope you can sort it... let us know how it goes.