Secondary Storage VM in CloudStack Failing to Use Uploaded Certificate

[MejdiB]

Description:

We've encountered an issue with the Secondary Storage VM in CloudStack where it is not accepting the uploaded SSL certificate. Instead, it defaults to a self-signed certificate, which is causing browser warnings.

Details:

• The issue is present in ACS 4.17.1.
• The problem has been occurring for the past 8 days, with no certification issues noted in the previous 9 months.
• A "static" certificate is in use; no Certbot certificates are involved.
• The browser indicates that the certificate authority is "CN=systemvm."
• ISO Management: Downloading and uploading ISOs only proceeds if the user clicks "Accept the Risk and continue."
• There is no such problem at the Console Proxy, there, the right certificate is used

Steps to Reproduce:

• Upload a valid SSL certificate to the Secondary Storage VM.
• Attempt to access the storage via a browser.
• Observe the browser warning indicating the use of a self-signed certificate.

Additional Information:

• Reboot and Destroy: Attempts to reboot or destroy the VM have not resolved the issue.

[rajujith]

@MejdiB you try the steps in the blog [1]? if the issue persists can you check the management-server.log for any errors during the certificate upload?

[1] https://www.shapeblue.com/securing-cloudstack-4-11-with-https-tls/

[MejdiB]

@rajujith Yes, the process is well-known to me. After doing some investigations it turned out that a live migration from the secondary storage VM to another cluster solved the problem. I did not understand why applying the uploaded certificates did not work on the other cluster and moreover, certing Console Proxy worked fine. However, I will not do any further investigations into this behaviour.