Unable to Add Cluster or acquisition fails for existing clusters on AIQUM due to expired client certificate
Applies to
- Active IQ Unified Manager (AIQUM)
- ONTAP 9
- AIQUM and ONTAP cluster are time-syncronized by using the same NTP settings
- AIQUM was installed over 5 years ago
Note: The installation date can be confirmed with Install_Upgrade.log
------ postinst start Sat Feb 9 10:10:20 UTC 2019 ------
Issue
- Attempting to add ONTAP cluster to AIQUM fails:
Unable to add cluster data source. This can occur if the clocks on the systems are not synchronized and the Active IQ Unified Manager HTTPS certificate start date is later than the date on the cluster, or if the cluster has reached the maximum number of EMS notification destinations.ocumserver.login AIQUM indicates HTTP 500 withFailed to add the datasource
INFO [admin] [default task-22] [c.n.d.o.o.s.z.OntapSecurityCertificateZapiService] Installing self-signed client certicate on ONTAP
..
ERROR [admin] [default task-22] [c.n.d.c.h.DatasourcesHttpClientManager] Failed to add the datasource
com.onaro.commons.exception.ConfigurationException: Server returned HTTP status 500.HTTP error message :{"timestamp":"<TIMESTAMP>","status":500,"error":"Internal Server Error","path":"/acquisition-api/server/datasource"}
at com.netapp.mega//com.onaro.commons.framework.mgmt.HTTPClientManager.logHTTPErrorStatusWithMessage(HTTPClientManager.java:120)
at deployment.dfm-app.war//com.netapp.dfm.collector.httpclient.DatasourcesHttpClientManager.addDS(DatasourcesHttpClientManager.java:243)
at deployment.dfm-app.war//com.netapp.dfm.collector.OcieAcquisitionFacade.addDataSource(OcieAcquisitionFacade.java:287)
at deployment.dfm-app.war//com.netapp.dfm.collector.AbstractDataSourceManager.addDataSource(AbstractDataSourceManager.java:53)
at deployment.dfm-app.war//com.netapp.dfm.collector.AbstractDataSourceManager$$FastClassBySpringCGLIB$$babcc85.invoke(<generated>)
..
/etc/log/mlog/audit.login ONTAP cluster indicates certificate installation fails due to expired
[kern_audit:info:3167] 8503e80000dac04e :: clustername:ontapi :: xx.xxx.xxx.xx:52938 :: clustername:user :: security-certificate-install :: Error: The certificate has expired.server_acq.login AIQUM indicates certificate is expired
ERROR [default task-6260] c.n.s.a.s.r.s.i.AcquisitionFacadeSessionServiceImpl (AcquisitionFacadeSessionServiceImpl.java:843) - Fail to add data source for acquisitionUnitName: local, dataSourceName: <cluster name>, vendor:NetApp OCI Essentials, model: NetApp OCI Essentials, datasourceTypeId: 91, manual: 1, isActive: false, attrs: -- listing properties --
<truncated>
: com.netapp.oci.netapp.client.interfaces.data.EmsManagerException: The certificate has expired. (errno=61105) (errno=
..
ERROR [default task-340653] c.o.s.a.s.AcquisitionFacadeUtil (AcquisitionFacadeUtil.java:202) - failed to register EMS: : com.netapp.oci.netapp.client.interfaces.data.EmsManagerException: The certificate has expired. (errno=61105)