NetWorker VMware Backup failing with SSL Certificate error on 19.10.0.x and 19.11.0.x
Summary: NetWorker VMware Protection (NVP) backups failing with SSL certificate error on version 19.10.0.x and 19.11.0.x
Symptoms
Impacted NetWorker versions:
- 19.10.0.0 to 19.10.0.4
- 19.11.0.0 to 19.11.0.1
Post upgrading NetWorker to one of the impacted releases, the below error is seen and VMware backup are failing because of it:
MM/DD/YYYY HH:mm:SS Received the media management binding information on the host 'NETWORKER_SERVER_NAME'. MM/DD/YYYY HH:mm:SS Connected to the nsrmmd process on the host 'NETWORKER_SERVER_NAME'. MM/DD/YYYY HH:mm:SS sapsolmgr01: Unable to start backup on vProxy 'vPROXY_NAME': libCURL: function "curl_easy_perform" returned error 60: "SSL certificate problem: self signed certificate"
The NetWorker server's daemon.raw reports the following error:
Linux: /nsr/logs/daemon.raw
Windows: C:\Program Files\EMC NetWorker\nsr\logs\daemon.raw
NetWorker: How to use nsr_render_log to render .raw log files
206462 MM/DD/YY HH:mm:SS 5 15 17 2092 5444 0 NETWORKER_SERVER_NAME *nsrd BSAFE critical Couldn't confirm if 'C:\Program Files\EMC NetWorker\nsr\sec\authcerts\NETWORKER_SERVER_NAME.cacert' is a CA certificate: NULL_ARG *
Cause
After each reboot, service restart, and NetWorker upgrade, NetWorker server tries to validate the CA certificate which is used for vProxy from path:
\Program Files\EMC NetWorker\nsr\sec\authcerts\NETWORKER_SERVER_NAME.cacert
Linux:
/nsr/sec/authcerts/NETWORKER_SERVER_NAME.cacert
There is a defect in the NetWorker server code.
When there is a failure to validate this CA certificate, vProxies are unregistered and registered again so that the same certificate cannot be created again. During this process of vProxy, if any issue happens to the vProxy, it leaves behind the vProxy as unregistered and an SSL certificate error is observed.
For example, if the nsrdisp_vproxy process failed during re-registration, this left behind the vProxy as unregistered. The respective VMware backups which used this same vProxy failed.
Resolution
The fix is available on NetWorker version 19.10.0.5/19.11.0.2 and above.
Ensure vProxy are also upgraded to 4.4.0-x as it also contains part of the remediation for the defect.
Workaround:
Unregister and reregister the vProxy: NVP vProxy: How To Unregister/Re-Register a vProxy Appliance?