Upgrade 4.3 to 4.4 node to manager communication error
I have a communication problem between all the nodes and the manager following the upgrade from 4.3 to 4.4. I followed the procedure of update 4.3 to 4.4 everything worked correctly, according to the import export scripts as well as the installation setup on the new manager in 4.4, all is ok. Only after connection to the manager, all the nodes are in a down state, there is no more communication between the manager newly installed in 4.4 and the nodes still in production in 4.3. In the manager I have this message for all the nodes: ` VDSM virtdell8 command Get Host Capabilities failed: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA256withRSA` And on the nodes: ` 2020-09-01 17:38:13,083+0200 ERROR (Reactor thread) [ProtocolDetector.SSLHandshakeDispatcher] ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX (sslutils:264) vdsm[4400]: ERROR ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX` After a search on the forums I found a similar error on version 4.2 only the solution of comment `ssl_excludes` in the `/etc/vdsm/vdsm.conf` file but does not apply to my problem. I unfortunately had to backtrack because it was no longer possible to control ovirt and use the manager for our production. the new machine with the manager in 4.4 is offline while a solution is found Do you know where should I look in order to solve this problem? thank you in advance Pierre
On Thu, Sep 3, 2020 at 2:56 PM Pierre pit <pierre.labanowski@xlim.fr> wrote:
I have a communication problem between all the nodes and the manager following the upgrade from 4.3 to 4.4. I followed the procedure of update 4.3 to 4.4 everything worked correctly, according to the import export scripts as well as the installation setup on the new manager in 4.4, all is ok. Only after connection to the manager, all the nodes are in a down state, there is no more communication between the manager newly installed in 4.4 and the nodes still in production in 4.3.
In the manager I have this message for all the nodes: ` VDSM virtdell8 command Get Host Capabilities failed: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA256withRSA`
Hi Pierre, Hmm, the following error is a bit misleading, but it gives a clue to me. Could you please check the key size of your ovirt-engine CA key? openssl x509 -text -noout -in /etc/pki/ovirt-engine/ca.pem | grep 'RSA Public-Key' If your key size is less than 2048 bits, then you need to change crypto policy of your CentOS 8 to LEGACY using below steps: 1. Execute 'update-crypto-policies --set LEGACY' 2. Reboot the machine That should mitigate the issue, but I'm really curious, this should not happen unless your engine was installed in oVirt 3.0 era and then continuously upgraded up to 4.4, because we have switched to 2048 bits in 2012: https://gerrit.ovirt.org/4389 Is this your case? Regards, Martin
And on the nodes: ` 2020-09-01 17:38:13,083+0200 ERROR (Reactor thread) [ProtocolDetector.SSLHandshakeDispatcher] ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX (sslutils:264) vdsm[4400]: ERROR ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX`
After a search on the forums I found a similar error on version 4.2 only the solution of comment `ssl_excludes` in the `/etc/vdsm/vdsm.conf` file but does not apply to my problem.
I unfortunately had to backtrack because it was no longer possible to control ovirt and use the manager for our production. the new machine with the manager in 4.4 is offline while a solution is found
Do you know where should I look in order to solve this problem?
thank you in advance Pierre _______________________________________________ Users mailing list -- users@ovirt.org To unsubscribe send an email to users-leave@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/CE34HLTRN54HVO...
-- Martin Perina Manager, Software Engineering Red Hat Czech s.r.o.
On Thu, Sep 3, 2020 at 4:49 PM Martin Perina <mperina@redhat.com> wrote:
On Thu, Sep 3, 2020 at 2:56 PM Pierre pit <pierre.labanowski@xlim.fr> wrote:
I have a communication problem between all the nodes and the manager following the upgrade from 4.3 to 4.4. I followed the procedure of update 4.3 to 4.4 everything worked correctly, according to the import export scripts as well as the installation setup on the new manager in 4.4, all is ok. Only after connection to the manager, all the nodes are in a down state, there is no more communication between the manager newly installed in 4.4 and the nodes still in production in 4.3.
In the manager I have this message for all the nodes: ` VDSM virtdell8 command Get Host Capabilities failed: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA256withRSA`
Are you sure this is the full error? Searching for it in google finds me only 2 results. Dropping "SHA256withRSA" finds about 770, which gave me a clue to search for: "Algorithm constraints check failed on signature algorithm:SHA256WithRSAEncryption" which finds 25 results. Not that many, but more than 2.
Hi Pierre,
Hmm, the following error is a bit misleading, but it gives a clue to me. Could you please check the key size of your ovirt-engine CA key?
openssl x509 -text -noout -in /etc/pki/ovirt-engine/ca.pem | grep 'RSA Public-Key'
If your key size is less than 2048 bits, then you need to change crypto policy of your CentOS 8 to LEGACY using below steps:
1. Execute 'update-crypto-policies --set LEGACY' 2. Reboot the machine
That should mitigate the issue, but I'm really curious, this should not happen unless your engine was installed in oVirt 3.0 era and then continuously upgraded up to 4.4, because we have switched to 2048 bits in 2012:
Is this your case?
Also: anything non-default, non-standard about your setup? Either before or after the upgrade? In particular, added yum/dnf repos (such as EPEL)? Which openjdk versions do you have installed? Best regards,
Regards, Martin
And on the nodes: ` 2020-09-01 17:38:13,083+0200 ERROR (Reactor thread) [ProtocolDetector.SSLHandshakeDispatcher] ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX (sslutils:264) vdsm[4400]: ERROR ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX`
After a search on the forums I found a similar error on version 4.2 only the solution of comment `ssl_excludes` in the `/etc/vdsm/vdsm.conf` file but does not apply to my problem.
I unfortunately had to backtrack because it was no longer possible to control ovirt and use the manager for our production. the new machine with the manager in 4.4 is offline while a solution is found
Do you know where should I look in order to solve this problem?
thank you in advance Pierre _______________________________________________ Users mailing list -- users@ovirt.org To unsubscribe send an email to users-leave@ovirt.org Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/CE34HLTRN54HVO...
-- Martin Perina Manager, Software Engineering Red Hat Czech s.r.o.
-- Didi
Le 03/09/2020 à 15:49, Martin Perina a écrit :
On Thu, Sep 3, 2020 at 2:56 PM Pierre pit <pierre.labanowski@xlim.fr <mailto:pierre.labanowski@xlim.fr>> wrote:
I have a communication problem between all the nodes and the manager following the upgrade from 4.3 to 4.4. I followed the procedure of update 4.3 to 4.4 everything worked correctly, according to the import export scripts as well as the installation setup on the new manager in 4.4, all is ok. Only after connection to the manager, all the nodes are in a down state, there is no more communication between the manager newly installed in 4.4 and the nodes still in production in 4.3.
In the manager I have this message for all the nodes: ` VDSM virtdell8 command Get Host Capabilities failed: PKIX path validation failed: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA256withRSA`
Hi Pierre,
Hmm, the following error is a bit misleading, but it gives a clue to me. Could you please check the key size of your ovirt-engine CA key?
openssl x509 -text -noout -in /etc/pki/ovirt-engine/ca.pem | grep 'RSA Public-Key'
Hi Martin, Thank you very much for your answer. indeed the size of the key is 1024 bits. I made the command "update-crypto-policies --set LEGACY" (I don't know this command) Everything is ok now. thank you very much for your expertise. \o/
If your key size is less than 2048 bits, then you need to change crypto policy of your CentOS 8 to LEGACY using below steps:
1. Execute 'update-crypto-policies --set LEGACY' 2. Reboot the machine
That should mitigate the issue, but I'm really curious, this should not happen unless your engine was installed in oVirt 3.0 era and then continuously upgraded up to 4.4, because we have switched to 2048 bits in 2012:
It has actually been a long time since I upgrade ovirt from version to version. i had some mishaps with ovirt 2.2 and it seems to me since ovirt 3.0 the upgrade is done regularly.
Is this your case?
no, is not me again thanks for your reply i could not find it all alone. Regards, Pierre
Regards, Martin
And on the nodes: ` 2020-09-01 17:38:13,083+0200 ERROR (Reactor thread) [ProtocolDetector.SSLHandshakeDispatcher] ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX (sslutils:264) vdsm[4400]: ERROR ssl handshake: SSLError, address: ::ffff:XXX.XXX.XXX.XXX`
After a search on the forums I found a similar error on version 4.2 only the solution of comment `ssl_excludes` in the `/etc/vdsm/vdsm.conf` file but does not apply to my problem.
I unfortunately had to backtrack because it was no longer possible to control ovirt and use the manager for our production. the new machine with the manager in 4.4 is offline while a solution is found
Do you know where should I look in order to solve this problem?
thank you in advance Pierre _______________________________________________ Users mailing list -- users@ovirt.org <mailto:users@ovirt.org> To unsubscribe send an email to users-leave@ovirt.org <mailto:users-leave@ovirt.org> Privacy Statement: https://www.ovirt.org/privacy-policy.html oVirt Code of Conduct: https://www.ovirt.org/community/about/community-guidelines/ List Archives: https://lists.ovirt.org/archives/list/users@ovirt.org/message/CE34HLTRN54HVO...
-- Martin Perina Manager, Software Engineering Red Hat Czech s.r.o.
participants (4)
-
Martin Perina -
Pierre Labanowski -
Pierre pit
-
Yedidyah Bar David