HSTS errors are seen in your client browser when accessing the vRA VAMI when using self-signed certificates
search cancel

HSTS errors are seen in your client browser when accessing the vRA VAMI when using self-signed certificates

book

Article ID: 325907

calendar_today

Updated On:

Products

VMware Aria Suite

Issue/Introduction

Symptoms:
  • When you access the VAMI URL, browsers returns an error related to self-signed certificate and you can not proceed.
  • Latest versions of Chromium based browsers prevent users from navigating to the 5480 web interface.
  • Firefox provides a way to add an exception with an warning similar to
    vami_url_FQDN:5480 uses an invalid security certificate
    
    The certificate is not trusted because it is self signed.
    The certificate is not valid for the name vami_url_FQDN.
    
    Error cod:SEC_ERROR_UNKNOWN_ISSUER
  • ​Internet Explorer 11 allows an option to continue on to the website but does not actually navigate to page and comes back to warning page.
    Your PC doesn't trust this website's security certificate.
    The hostname in the website's security certificate differs from the website you are trying to visit.
    
    Error code:DLG_FLAGS_INVALID_CA
    DLG_FLAGS_SEC_CERT_CN_INVALID
  • Microsoft Edge is a Chromium based browser and can be configured with
    edge://net-internals/#hsts


Environment

VMware vRealize Automation 7.x

Cause

This issue occurs due the default HSTS features enabled in modern client browsers and navigating to a web site with self-signed certificates.

Resolution

VMware recommends certifying all web interfaces on vRealize appliances with public CA certificates.

Workaround:
To work around this issue, use either of these options:

Option 1

  • Replace the self-signed certificates with a public CA signed certificate that contains the fully qualified domain name of the VA hostname in the Subject Alternative Name field.

Option 2

  • Disable HSTS in the Chrome browser.
    1. Disable browser cache.
    2. Type chrome://net-internals/#hsts in the chrome browser.
    3. If present, remove the domain name of vRA for Add HSTS/PKP domain. Click include sub-domains and check for both STS and PKP.
    4. If present, remove the domain name of vRA for Add Expect-CT domain.



Additional Information

简体中文:浏览器不完全支持对 vami 控制台进行基于自签名证书的访问