Avamar - Dell Cloud Director Data Protection Extension (DPE) vcpsrv 狀態關機，因為雲端憑證無效

VCP Manager 服務關閉
BG 服務關閉
DPE 無法連線至 vCloud

VCP Manager 記錄顯示憑證錯誤：

/var/log/vcp/vcp-manager.log 

2022-04-15 15:31:50,524 [main] ERROR (RestUtil.java:389) - null
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: java.security.cert.CertPathBuilderException: Could not build a validated path.
        at sun.security.ssl.Alert.createSSLException(Unknown Source) ~[?:1.8.0_301]
        at sun.security.ssl.TransportContext.fatal(Unknown Source) ~[?:1.8.0_301]

systemctl restart vcp-manager.service
sleep 30
vcp-cli srv update <srv-service-name from step 8>
vcp-cli bg update <bg service name from step 8>

憑證已在雲端上過期或更換，且 DPE 需要匯入新的雲端憑證。

先決條件：  取得金鑰存放區檔案的登入資料。  DPE 一律會產生隨機密碼金鑰存放區，因此我們必須使用以下命令與客戶主密碼來取得金鑰存放區
   

vcp-cli credential list -p <master_password>

範例輸出

# vcp-cli  credential list -p Changeme_1
getting credentials...
Success

credential:
   component: truststore
   url: /etc/vcp/truststore
   username:
   password: ZM1VnGwRZCLFrrNS

步驟 1
查看信任存放區中的目前憑證是否有雲端憑證，檢視日期以查看是否已過期，或檢視 SHA1 指紋，查看其是否與套用至 vcloud 的目前憑證相符

 # vcp-cli certificate show-trust -a cloud 

範例輸出顯示舊的 vCloud 憑證目前已使用別名雲端載入至信任存放區 

Alias name: cloud
Creation date: Sep 8, 2021
Entry type: trustedCertEntry

[..]
Valid from: Wed Mar 24 09:32:46 EDT 2021 until: Sat Apr 23 09:32:45 EDT 2022
Certificate fingerprints:
MD5:  B0:E2:12:5D:46:4D:DC:09:FB:2C:EF:94:7D:29:EB:DF
SHA1: C4:0A:BE:56:D5:25:A1:49:00:94:9E:9D:46:FD:6F:64:1D:59:A7:E8       SHA256:40:67:86:D2:EE:58:72:24:E0:52:88:33:4E:C8:9E:44:9E:B0:24:EE:65:2E:AD:5C:D3:40:97:44:AD:04:48:3B

記下 SHA1 指紋和日期：
在此範例中，指紋為：C4:0A:BE:56:D5:25:A1:49:00:94:9E:9D:46:FD:6F:64:1D:59:A7:E8
在此範例中，憑證有效期至：  Sat Apr 23 09:32:45 EDT 2022

步驟 2
使用新的 keytool 命令，讓 TLS 連線至雲端並取得 SHA1 指紋 

# keytool  -printcert -sslserver <cloud director hostname or ip>:443 -rfc | openssl x509 -noout -fingerprint -dates

範例輸出

SHA1 Fingerprint=94:2F:74:56:9C:19:61:2D:7E:24:60:4A:8A:2F:89:D7:31:34:19:A4
notBefore=Dec 29 18:59:49 2021 GMT
notAfter=Dec 29 18:59:49 2022 GMT

如果指紋不符，或日期不符。您需要在 DPE 上更新雲端憑證。

步驟 3
製作信任存放區的複製

cp -p /etc/vcp/truststore /etc/vcp/truststore-`date -I`.bkp

步驟 4
若要更換 DPE 上信任存放區中的憑證，請先刪除舊憑證

keytool -delete  -alias cloud -keystore /etc/vcp/truststore -storepass <keystore_passphrase> 

步驟 5
將目前的 vCloud 憑證下載至新檔案：new_cloud_cert.crt 

keytool -printcert -rfc -sslserver <Cloud_hostname>:443 > new_cloud_cert.crt

步驟 6
將認證檔案匯入信任存放區

keytool -import -file new_cloud_cert.crt -alias cloud  -keystore /etc/vcp/truststore -storepass <keystore_passphrase> 

步驟 7
再次重複步驟 1 的命令，以確認已安裝新的憑證 

 # vcp-cli certificate show-trust -a cloud 

範例輸出

Alias name: cloud 
Creation date: Jul 27, 2022
Entry type: trustedCertEntry

Owner: CN=vcd.example.lab
Issuer: CN=vcd.example.lab
Serial number: 7e29bef2a5652b7a
Valid from: Wed Dec 29 13:59:49 EST 2021 until: Thu Dec 29 13:59:49 EST 2022
Certificate fingerprints:
         MD5:  8A:5A:D1:09:AE:C8:D9:94:B6:B9:D3:A5:E9:BD:AA:07
         SHA1: 94:2F:74:56:9C:19:61:2D:7E:24:60:4A:8A:2F:89:D7:31:34:19:A4
         SHA256: 38:88:0F:5F:C1:8C:BB:F0:D9:64:40:72:D9:59:35:5E:2B:72:BB:50:2F:88:3B:B0:8D:4C:D5:16:56:35:19:E2

注意：
此建立日期應為今天的日期，且應更新 SHA1 指紋和憑證日期。

步驟 8
取得節點狀態以取得 BG 和 srv 的服務名稱 

vcp-cli node status

步驟 9
重新啟動服務 

systemctl restart vcp-manager.service
sleep 30
vcp-cli srv stop <srv-service-name> -p <master password>
vcp-cli srv start <srv-service-name> -p <master password>
vcp-cli bg stop <bg service name>  -p <master password>
vcp-cli bg start <bg service name> -p <master password>

步驟 10
檢查狀態

vcp-cli srv status
vcp-cli bg status