Dell Unity：升级到 5.5 后，Uemcli 命令失败，并显示“无法验证指定的证书”（客户可纠正）

• Uemcli 在 Unity OE 5.5 CLI 上运行的命令失败，并显示错误 "Unable to validate the specified certificate. (Error Code:0x1000100)". 

13:23:45 service@emcunity02-2 spa:~/user# uemcli /sys/general show
Storage system address: 127.0.0.1
Storage system port: 443
HTTPS connection

Operation failed. Error code: 0x1000100
Unable to validate the specified certificate. (Error Code:0x1000100)

• 从安装了最新 Uemcli 的 Windows 客户端和 Linux 客户端或低于 5.5 的 Unity OE 运行时，相同的命令不会失败。 
• 此问题仅发生在注入了 CA 签名证书的 Unity 系统上。 
• 升级前运行状况检查也将失败，因为脚本运行了多次 uemcli 命令。 

-------------------------------------Errors-------------------------------------
Platform: Check import session exists
The command to get server interfaces failed.
	 * Command: uemcli -noHeader -sslPolicy accept /import/session
	   show -detail
	 * Command output: Operation failed. Error code: 0x1000100 Unable to
	   validate the specified certificate. (Error Code:0x1000100)
	 
	 * Command exit code: 1
Action : Use the command output and exit code to investigate the
	 problem. Run the command manually if needed to investigate further.
	 Escalate this issue through your support organization if needed.
	 Provide this output in the escalation.

ERROR_CODE=platform::check_import_session_exists_1|Error|uemcli -noHeader -sslPolicy accept  /import/session show -detail|Operation failed. Error code: 0x1000100
 Unable to validate the specified certificate. (Error Code:0x1000100)
|1

<snip>

• 导入到 Unity 的证书链客户可能包含根 CA 证书，也可能不包含根 CA 证书。仅当导入的证书链包含根 CA 证书时，Unity 上才会出现此问题。 
• 解决方法可用，但根本原因仍在调查中。当根本原因可用时，知识库文章将更新。 
• 有 2 种方法可确认导入的证书链是否包含根 CA 证书。 

方法 1： 

使用 openssl s_client -connect <Unity mgmt ip:443> -showcerts 列出证书链。 

00:42:41 root@VIRT2213Y2XXXX spa:/cores/service/user# openssl s_client -connect 5.6.7.11:443 -showcerts
CONNECTED(00000003)
Can't use SSL_get_servername
depth=2 DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA
verify error:num=19:self signed certificate in certificate chain
verify return:1
depth=2 DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA
verify return:1
depth=1 DC = lab, DC = peeps, CN = peeps-WIN2022-CA
verify return:1
depth=0 C = IE, ST = Cork, L = Ovens, O = DellEMC, CN = peeps-pod1-unityvsa.peeps.lab
verify return:1
---
Certificate chain
 0 s:C = IE, ST = Cork, L = Ovens, O = DellEMC, CN = peeps-pod1-unityvsa.peeps.lab
   i:DC = lab, DC = peeps, CN = peeps-WIN2022-CA
-----BEGIN CERTIFICATE-----
MIIFijCCBHKgAwIBAgITKAAAAAXARo9q7hUINgAAAAAABTANBgkqhkiG9w0BAQsF
ADBHMRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFcGVlcHMx
GTAXBgNVBAMTEHBlZXBzLVdJTjIwMjItQ0EwHhcNMjUwNTIwMjMxNDI3WhcNMjcw
NTE5MDYzMDUwWjBmMQswCQYDVQQGEwJJRTENMAsGA1UECBMEQ29yazEOMAwGA1UE
BxMFT3ZlbnMxEDAOBgNVBAoTB0RlbGxFTUMxJjAkBgNVBAMTHXBlZXBzLXBvZDEt
dW5pdHl2c2EucGVlcHMubGFiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAxzKCujxDYeAGNqJxLKEwXXRHWOfr0a3AYFzkvjcJu7ZWTvzB3LWmDcP/5J9F
Nk3vgLqHIlo2hYC9yPvmiApFRbc0Lge64G4JbjYiwjI55y6sBOUq+Xmf9FsveZxe
W/Cigm1PrTl7iO5WTOzkEJMWY6Zte9TwJNfZd+V+RXxH/+jxeXxZSDBCoc6Ei85+
SvPvggH7iA6pAw+LwhzhvOwwR7y40eA69VZ1ZIrYRVpnT5RHGLvte6FA7LHbCPpc
uKIAnmAJB0bwlEzWP1l7ea8vSSvVtk1aoLKBs7Xl/viL5A7JOZT3TFU2GFRETx4f
zLeYan1C1ySp2Fo7i7W805vKFQIDAQABo4ICTjCCAkowLgYDVR0RBCcwJYIdcGVl
cHMtcG9kMS11bml0eXZzYS5wZWVwcy5sYWKHBAUGBwswHQYDVR0OBBYEFG5A09yG
4WooK7xnC4M6cU2IhO9WMB8GA1UdIwQYMBaAFCRB/qFVh4GOD3cbAAg5PqiGHl1n
MIHMBgNVHR8EgcQwgcEwgb6ggbuggbiGgbVsZGFwOi8vL0NOPXBlZXBzLVdJTjIw
MjItQ0EsQ049V2luMjAyMixDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2Vydmlj
ZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1wZWVwcyxEQz1sYWI/
Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERp
c3RyaWJ1dGlvblBvaW50MIHABggrBgEFBQcBAQSBszCBsDCBrQYIKwYBBQUHMAKG
gaBsZGFwOi8vL0NOPXBlZXBzLVdJTjIwMjItQ0EsQ049QUlBLENOPVB1YmxpYyUy
MEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9
cGVlcHMsREM9bGFiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0
aWZpY2F0aW9uQXV0aG9yaXR5MCEGCSsGAQQBgjcUAgQUHhIAVwBlAGIAUwBlAHIA
dgBlAHIwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqG
SIb3DQEBCwUAA4IBAQBh919cjlWZECs2fkxsim3UUEmwEW9/QC7P/BQ0v8+PU+Hb
ZSowLW4rdWjcM9ba1vIpP6Y9vTkmhvkrlTJ4+i7iDUwOKwJN6X+uvZDaR5JTGHM8
SnryIYYvsHwlctxXp5HdimAHKFg3lBg06bx5nr7PvZToqKCPTJG/V/ewRh5tQIsG
ZeW6XUhtQm1UU5DOEmYaqKwOEDHuIU8h6+IusNEnHsKnfF0SXzbn9HInziLlFpQH
PJE1j/VS6WCCiDaxCBvpYSRAvLfY7o8uRrErBDiZEM1LTE35D8lcL/za+Bs2xddd
xWk/d17E0jdTUisdQ0ncdBL3PmYfP5gzf32yGjC0
-----END CERTIFICATE-----
 1 s:DC = lab, DC = peeps, CN = peeps-WIN2022-CA
   i:DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA
-----BEGIN CERTIFICATE-----
MIIFRTCCBC2gAwIBAgITZQAAAAiZqsv55QIu0gAAAAAACDANBgkqhkiG9w0BAQsF
ADBIMRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFcGVlcHMx
GjAYBgNVBAMTEXBlZXBzLVBFRVBTLURDLUNBMB4XDTI1MDUxOTA2MjA1MFoXDTI3
MDUxOTA2MzA1MFowRzETMBEGCgmSJomT8ixkARkWA2xhYjEVMBMGCgmSJomT8ixk
ARkWBXBlZXBzMRkwFwYDVQQDExBwZWVwcy1XSU4yMDIyLUNBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ympraX0vZIyIMtH7gsAmDJvWTBlJwrQDb1u
aGn6y8l+v1DozBL64V5gAYZ2VDr6aoixLAB1wcoIvTJVhUHxN4LbBzckTrs6D2q8
VkxAvCkQTUeCABdUpJ0/ByIaCNe5K35itsAsS95Z0hciSgvfjemjW7oXg086H4nP
v4uGI6Vvtr2MYkdSYrIrPArZJIPV1HVgQ7D4X2BVsCHTXkmQD4/BCP74mIvnuDJv
nk/i0OSBFsLB9c8/kHGGcRLJ9SJ5hFGOduHopZEMQDCEiQym5tuK1efhiEi6/38K
gjR5u1AkQT4KxUU/tX2e1NBpUJXoYFkETkcQLlYrZgl+gOuxHQIDAQABo4ICJzCC
AiMwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFCRB/qFVh4GOD3cbAAg5PqiG
Hl1nMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA4GA1UdDwEB/wQEAwIBhjAP
BgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFFSCaAVg4Psk4F1W6qKsSoFube2i
MIHOBgNVHR8EgcYwgcMwgcCggb2ggbqGgbdsZGFwOi8vL0NOPXBlZXBzLVBFRVBT
LURDLUNBLENOPXBlZXBzLWRjLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2
aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXBlZXBzLERDPWxh
Yj9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM
RGlzdHJpYnV0aW9uUG9pbnQwgcEGCCsGAQUFBwEBBIG0MIGxMIGuBggrBgEFBQcw
AoaBoWxkYXA6Ly8vQ049cGVlcHMtUEVFUFMtREMtQ0EsQ049QUlBLENOPVB1Ymxp
YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s
REM9cGVlcHMsREM9bGFiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1j
ZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MA0GCSqGSIb3DQEBCwUAA4IBAQAFLk+6PCFY
tHjaKJWcU/mso1toeiiMdPJRlniimfjWjYPoW1A44kSMN1OQapNNWIKDpgbWwIm8
A/eeYI3tFAD+1MmzVXQR1jrqEYN9vYXmGCW3C2I5jG54/1rCCAF9Ba+okFBIp3zf
0M9O5DDMPP0I5LD5vgGisJk2vLbJjeVMAFJOm1I7X6dYtCDWMgd+i5/EgKo5X1Fv
nGciDXsUJjZk54Ej39wg8zSp7lUYq8dUZmXZChRo+IGXNaty4IMQWgcXroKIHr8f
qJA39PNmjhw8p1cuJBV0REFGg4HK+VzzIGw/imnqxbfCNPzZyMCkopjmaiI7QavI
uvtahyigFeMx
-----END CERTIFICATE-----
 2 s:DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA   <<<<<<
   i:DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA   <<<<<<
-----BEGIN CERTIFICATE-----
MIIDazCCAlOgAwIBAgIQcbdXPmtT24tP3mCqSRnANTANBgkqhkiG9w0BAQsFADBI
MRMwEQYKCZImiZPyLGQBGRYDbGFiMRUwEwYKCZImiZPyLGQBGRYFcGVlcHMxGjAY
BgNVBAMTEXBlZXBzLVBFRVBTLURDLUNBMB4XDTI1MDUxOTAxMTk1NloXDTMwMDUx
OTAxMjkzOVowSDETMBEGCgmSJomT8ixkARkWA2xhYjEVMBMGCgmSJomT8ixkARkW
BXBlZXBzMRowGAYDVQQDExFwZWVwcy1QRUVQUy1EQy1DQTCCASIwDQYJKoZIhvcN
AQEBBQADggEPADCCAQoCggEBAPQ3hF4Pdyj366ViYt1vNGCVHQSDyJXRMYtjV1xj
+lgUycQ4TSyTzZUIWQ8sX6W6xv0kMpD1d7FFumEHQeJ+3JhXk45FpNdG3qOWsecT
CiCfnxV62Vf6hbQ6Hu46tVMme+4ayAR8zXaB8vvtjx3QfafIhpmNRB+5jehaPKwv
1SaWRF5suMN9vEyYsn4jageYSDV0KHVCcvxFjkmPACM8VsMpQLAS/RfgggYMyp3r
s5c39Cu3VYgtvVSKzIJ9x59pcMuGzLbAIYxw3ILyQHMLBr0FxN9Ek8T7DgaCm5Oa
HiB2KeHhmfB2SekOjclE/pYu+EBe7C9H6gJo8kvtF6RusGUCAwEAAaNRME8wCwYD
VR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFSCaAVg4Psk4F1W
6qKsSoFube2iMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEBCwUAA4IBAQCw
3ZtvPVjhKfatebA5/hCviB4kCgWTc8BR80CVKfoNJb9EoDjK9X65fJMOcgtwBfvj
lkVxYSG6BZ6eWOhnmJXL0VzOOALtcxSyoF882slYlVyUxt5WGi6OTa8tq8PCzcSF
m/kDCl6BRsIYGUbOap7ziipic4JGBpN6bxg+gvcd+npkdiGXn+QHpD3WqxfQvyhM
KwiTvoNZ5Fhjgfcv0gvjTLFSBr1oTjNAkLWy5lU0BUHa4ATbUe6f6dlj+FIt2wQa
TjQU8tDqXqI4PT35zu1AdRJaG29CSCjojSe5DZ3h3zH+gHRdNbNiepuF8hiSf0IX
UaFgDdJFwfcudiOeqv11
-----END CERTIFICATE-----

根 CA 证书是自签名证书，并且始终具有相同的主题和颁发者。 

 2 s:DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA   <<<<<<
   i:DC = lab, DC = peeps, CN = peeps-PEEPS-DC-CA   <<<<<<

方法 2：

在该节点上运行 openssl x509 in <certificate file> -text -noout | grep -E "Issuer:|Subject:" 以列出证书。 

00:50:09 root@VIRT2213Y2XXXX spa:/cores/service/user# openssl x509 -in unity_pod1.pem -text -noout | grep -E "Issuer:|Subject:"
        Issuer: DC = lab, DC = peeps, CN = peeps-WIN2022-CA
        Subject: C = IE, ST = Cork, L = Ovens, O = DellEMC, CN = peeps-pod1-unityvsa.peeps.lab
        Issuer: DC = lab, DC = peeps, CN = peeps-WIN2022-CA  <<<<<<<<
        Subject: DC = lab, DC = peeps, CN = peeps-WIN2022-CA  <<<<<<<

解决办法：

• 按照KB000021122将 不 包含根 CA 证书的新证书链导入 Unity。 

请注意： 

• 如果 Unity 证书由根 CA 签名，则导入到 Unity 的证书应该是单个证书，即 Unity 证书本身。  
• 如果 Unity 证书由中间 CA 签名，则必须将证书链配置为完整的有序序列。此链必须包括：

1. Unity 服务器证书（最终实体证书），

2. 分层路径中的所有中间 CA 证书

3. 不包括根 CA 证书，该证书必须已存在于客户端的信任存储中。

该链应从最终实体证书向下到直接颁发者进行排序，以确保客户端可以跟踪到预受信任根 CA 的信任路径。例如：

Unity Certificate → Intermediate CA 2 → Intermediate CA 1