Troubleshooting vLCM UI firmware bundle display issues: SSL certificate cannot be verified

Unified Compute Platform (UCP) Advisor Administration Guide
Version
4.6.x
Audience
anonymous
Part Number
MK-92UCP119-15
ft:lastEdition
2024-09-24

Use the following guidelines and suggested steps to help resolve issues with the vLCM UI not displaying UCP Advisor firmware bundles because the SSL certificate cannot be verified.

Condition:
The vLCM UI does not display the UCP Advisor firmware bundle.
Image showing no firmware bundle getting listed in the vLCM UI

What it Means:
vCenter is unable to verify the UCP Advisor SSL certificate. See the vCenter HSM logs: 
root@VCSA-111 [ ~ ]# cat /storage/log/vmware/vmware-updatemgr/vum-server/hsm-service.log
SSL certificate verify failed: HTTPSConnectionPool(host='<HOST_IP>', port=443): Max retries exceeded with url: /hsm/vsphere-lcm/hw-support/v1/packages (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1076)')))
Corrective Action:
Note: If you have a three-node cluster, you must perform steps 1 to 4 on Worker Node1 VM and steps 5 to 12 on the Master Node VM. Verify that the label app is set to ucp on the Worker Node1 VM by running the following command:
kubectl get nodes -l app=ucp
  1. Using SSH, log on to the UCP Advisor VM.
  2. Generate a self-signed SSL key pair. Enter:
    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 364 -nodes -subj "/C=<Country Name>/ST=<State Name>/L=<City Name>/O=<Organization/Company name>/OU=<Organization Unit Name>/CN=<hostname for the UCP Advisor VM>"
    For example:
    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 364 -nodes -subj "/C=US/ST=California/L=Santa Clara/O=Hitachi Vantara/OU=SIE/CN=example.domain.com"
  3. Copy the certificate key pair to the /var/ucpadvisor/logs directory. Enter:
    cp -r cert.pem key.pem /var/ucpadvisor/logs
  4. Grant execute permissions to the certificate. Enter:
    chmod 555 /var/ucpadvisor/logs/*.pem
  5. Edit the Kong pod deployment. Enter:
    kubectl edit deploy ucpadvisor-kong -n ucp

    This opens the vi editor. Add the following lines above the - name: KONG_LUA_PACKAGE_PATH line.

    - name: KONG_SSL_CERT
value: /var/ucpadvisor/logs/cert.pem
- name: KONG_SSL_CERT_KEY
value: /var/ucpadvisor/logs/key.pem
    Note: Verify that the formatting is retained.
  6. Save the file. Enter:
    :wq
  7. Exit the vi editor. Press the Esc key.

    This restarts the Kong pod.

  8. Monitor the status of the Kong pod. Enter:
    kubectl get pods -n ucp
  9. After the Kong pod is restarted, log on to UCP Advisor, and verify the certificate in the browser.
  10. Unregister the UCP Advisor plugin. See Unregistering a UCP Advisor plugin.
  11. Register the UCP Advisor plugin. See Registering the UCP Advisor plugin.
  12. In a new browser, log on to vCenter and verify that the vLCM UI lists the firmware bundle.