Skip to main content
NetApp Knowledge Base

ONTAP AutoSupport using HTTPS fails validation when the Certificate is removed

  1. Last updated
    May 9, 2025
  2. Save as PDF
Views:
5,467
Visibility:
Public
Votes:
5
Category:
ontap-9
Specialty:
core
Last Updated:
5/9/2025, 6:32:12 AM

Applies to

  • ONTAP 9.7 and later
  • AutoSupport
  • Transport HTTPS

Issue

  • AutoSupports are no longer succeeding after removing some certificates from the truststore:

cluster1::*> system node autosupport check show-details -node * -check-type https-post-destination

Node: cluster1-01
 
Category: https
          Component: https-post-destination
             Status: failed
             Detail: HTTPS POST connectivity check failed for destination:
https://support.netapp.com/asupprod/post/1.0/postAsup.
                     Error: Peer certificate can not be authenticated with
                     given Certificate Authority certificates.
  Corrective Action: Certificate issue. Please make sure you have the correct
                     Root Certificate installed

  • Verify if the following certificate is missing

cluster1::> security certificate show-truststore -common-name AAACertificateServices

There are no entries matching your query.

cluster1::> security certificate show -common-name AAACertificateServices

There are no entries matching your query.

Cause

  • The Server-CA certificate is missing which is used by ONTAP to authenticate with the Support URL for HTTPS: support.netapp.com/asupprod/post/1.0/postAsup
  • The common name for the certificate is AAACertificateServices 
  • The certificate was removed 1 of 2 ways:
    • The advanced privilege command security certificate truststore clear was executed:
      • cluster1::*> security certificate truststore clear
    • The advanced privilege command security certificate delete was executed:
      • cluster1::*> security certificate delete -vserver cluster1 -common-name AAACertificateServices -ca "AAA Certificate Services" -type server-ca -serial 01
  • This issue is tracked in Bug  ID 1221636

Solution

To resolve this issue select one of the following options:
Reloading the Truststore
  • This will add back the AAACertificateServices root certificate along with all other default root certificates
  • ​​​​​Execute the security certificate truststore load command at the advanced privilege level:

cluster1::*> security certificate truststore load

Manually Add the Individual Certificate used for AutoSupport
  • This will add back only the AAACertificateServices root certificate
  • Following is the current AAACertificateServices certificate as of the time of publishing this article; however, the truststore is the best method as it will ensure the current certificate is loaded
  • Use the security certificate install command:

cluster1::> security certificate install -type server-ca

Please enter Certificate: Press <Enter> when done

-----BEGIN CERTIFICATE-----
MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEbMBkGA1UECAwS
R3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRowGAYDVQQKDBFDb21vZG8gQ0Eg
TGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmljYXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAw
MFoXDTI4MTIzMTIzNTk1OVowezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hl
c3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNV
BAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQuaBtDFcCLNSS1UY8y2bmhG
C1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe3M/vg4aijJRPn2jymJBGhCfHdr/jzDUs
i14HZGWCwEiwqJH5YZ92IFCokcdmtet4YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszW
Y19zjNoFmag4qMsXeDZRrOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjH
Ypy+g8cmez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQUoBEK
Iz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wewYDVR0f
BHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20vQUFBQ2VydGlmaWNhdGVTZXJ2aWNl
cy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2Vz
LmNybDANBgkqhkiG9w0BAQUFAAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm
7l3sAg9g1o1QGE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2G9w84FoVxp7Z
8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsil2D4kF501KKaU73yqWjgom7C
12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
-----END CERTIFICATE-----

 

You should keep a copy of the CA-signed digital certificate for future reference.
 
The installed certificate's CA and serial number for reference:
CA: AAA Certificate Services
serial: 01
 
The certificate's generated name for reference: AAACertificateServices​​​​​ 

Additional Information

Temporary WorkAround
  • There is one way to work around this behavior by disabling Certificate validation
  • This will configure all controllers in your cluster to not validate the server certificate it receives from support.netapp.com
  • This is a temporary fix to resume delivery of Autosupport logs until the issue can be fully resolved
  • Configure the storage controller to skip the server certificate in the validation process
cluster1::> system node autosupport modify -node <node> -transport https -support enable -validate-digital-certificate false
Documentation

 

 

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.