I would re-enroll the hosts from the web UI to verify that some cert was not missed.<div><br></div><div><br></div><div>Best Regards,</div><div>Strahil Nikolov&nbsp;<br><div> <br> <blockquote style="margin: 0 0 20px 0;"> <div style="font-family:Roboto, sans-serif; color:#6D00F6;"> <div>On Thu, Sep 1, 2022 at 19:42, Kilian Ries</div><div>&lt;mail@kilian-ries.de&gt; wrote:</div> </div> <div style="padding: 10px 0 0 20px; margin: 10px 0 0 0; border-left: 1px solid #6D00F6;"> <div id="yiv6336353077">

 
<style type="text/css"><!--#yiv6336353077 P {margin-top:0;margin-bottom:0;}--></style>

<div dir="ltr">
<div id="yiv6336353077divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri, Helvetica, sans-serif;" dir="ltr">
<p>Hi,</p>
<p><br>
</p>
<p>im running an oVirt 4.2.8 cluster with two nodes. A few days ago, my SSL certificates expired. After that, i changed all the certificates on the engine via "engine-upgrade" command and issued new vdsm client certificates. Then i copied the new certificates
 to my ovirt nodes and restarted vdsmd (systemctl restart vdsmd).&nbsp;</p>
<p><br>
</p>
<p>Now i'm still not able to connect to my ovirt nodes. In the engine log i can see the following error:&nbsp;</p>
<p><br>
</p>
<p>###</p>
<p><br>
</p>
<p>2022-09-01 18:25:51,822+02 INFO &nbsp;[org.ovirt.vdsm.jsonrpc.client.reactors.ReactorClient] (SSL Stomp Reactor) [] Connecting to /192.168.xx.xx</p>
<p>2022-09-01 18:25:51,827+02 ERROR [org.ovirt.vdsm.jsonrpc.client.reactors.Reactor] (SSL Stomp Reactor) [] Unable to process messages The server selected protocol version TLS10 is not accepted by client preferences [TLS12]</p>
<p>2022-09-01 18:25:51,829+02 ERROR [org.ovirt.engine.core.vdsbroker.monitoring.HostMonitoring] (EE-ManagedThreadFactory-engineScheduled-Thread-88) [] Unable to RefreshCapabilities: VDSNetworkException: VDSGenericException: VDSNetworkException: The server selected
 protocol version TLS10 is not accepted by client preferences [TLS12]</p>
<p><br>
</p>
<p>###</p>
<p><br>
</p>
<p>I searched my vdsm client config but i cannot see any specific TLS version set (every option with TLS is commented - seems to be the default):&nbsp;</p>
<p><br>
</p>
<p>###</p>
<p><br>
</p>
<p>$grep -R -i TLS /etc/vdsm/</p>
<p>/etc/vdsm/vdsm.conf:# ssl_protocol = tlsv1</p>
<p>/etc/vdsm/vdsm.conf:# https://docs.python.org/2/library/ssl.html. e.g. OP_NO_TLSv1,</p>
<p>/etc/vdsm/vdsm.conf:# OP_NO_TLSv1_1 By default tlv1, tlsv1.1 and tlsv1.2 are enabled.</p>
<p><br>
</p>
<p>###</p>
<p><br>
</p>
<p>On the engine i didn't find any setting to set a specific TLS version - there seems to have been a setting (VdsmSSLProtocol) but that got deprecated years ago.&nbsp;</p>
<p><br>
</p>
<p>Does anybody know why my engine is still not able to connect to the client vdsmd?</p>
<p><br>
</p>
<p>I also tried to set "<span style="font-size:12pt;"></span><span style="font-size:12pt;">ssl_protocol = tlsv1" via vdsm.conf but that didn't work ...&nbsp;</span></p>
<p><span style="font-size:12pt;"><br>
</span></p>
<p><span style="font-size:12pt;">Thanks</span></p>
<p><span style="font-size:12pt;">Regards,</span></p>
<p><span style="font-size:12pt;">Kilian</span></p>
<p><span style="font-size:12pt;"><br>
</span></p>
<p><span style="font-size:12pt;"><br>
</span></p>
<p><span style="font-size:12pt;">PS:&nbsp;</span></p>
<p><span style="font-size:12pt;"><br>
</span></p>
<p>Name &nbsp; &nbsp; &nbsp; : vdsm</p>
<p>Architektur : x86_64</p>
<p>Version &nbsp; &nbsp;: 4.19.37</p>
<p>Ausgabe &nbsp; &nbsp;: 1.el7.centos</p>
<p><br>
</p>
<p><br>
</p>
<p>Name &nbsp; &nbsp; &nbsp; : ovirt-engine</p>
<p>Architektur : noarch</p>
<p>Version &nbsp; &nbsp;: 4.2.8.2</p>
<p>Ausgabe &nbsp; &nbsp;: 1.el7</p>
<p><br>
</p>
</div>
</div>

</div>_______________________________________________<br>Users mailing list -- <a ymailto="mailto:users@ovirt.org" href="mailto:users@ovirt.org">users@ovirt.org</a><br>To unsubscribe send an email to <a ymailto="mailto:users-leave@ovirt.org" href="mailto:users-leave@ovirt.org">users-leave@ovirt.org</a><br>Privacy Statement: <a href="https://www.ovirt.org/privacy-policy.html" target="_blank">https://www.ovirt.org/privacy-policy.html</a><br>oVirt Code of Conduct: <a href="https://www.ovirt.org/community/about/community-guidelines/" target="_blank">https://www.ovirt.org/community/about/community-guidelines/</a><br>List Archives: <a href="https://lists.ovirt.org/archives/list/users@ovirt.org/message/QCSD37GWDX5WX7K4AWM7EE3NVZBMJN5I/" target="_blank">https://lists.ovirt.org/archives/list/users@ovirt.org/message/QCSD37GWDX5WX7K4AWM7EE3NVZBMJN5I/</a><br> </div> </blockquote></div></div>