• If vRealize Log Insight is running on default (out of box) certificates, the issue can present as the external certificate expiring, but in reality it's the internal certificate backing it that is expiring:

• To validate whether the internal certificate is expiring, run the following command from the vRealize Log Insight Primary node:

If the above command returns SSL client : Yes, then you can upgrade to VMware Aria Operations for Logs 8.12.  Please read Important Upgrade Notes on Certificates from the release notes before upgrading.

If the above command returns a value of SSL client : No, DO NOT attempt the VMware Aria Operations for Logs 8.12 upgrade.  Instead, create and apply a new custom certificate that allows Client Auth or revert to the default certificate by following the Revert to the default certificate instructions.  A custom certificate can be applied after upgrading to VMware Aria Operations for Logs 8.12, however the custom certificate must allow ClientAuth.

Revert to the default certificate

1. Log into the vRealize Log Insight UI as the local admin user.
2. Navigate to Configuration > SSL.
3. Click RESET TO DEFAULTS....

4. Click Reset.

• Scenario 1: Environment is using the default self-signed certificate that is expiring on April 30th 2023.The default certificate will need to be replaced by either a new custom certificate or by a new self-signed certificate. Once this is completed, the internal certificate will then need to be updated. The KB documents all of these steps.
• Scenario 2: Environment is using a updated self-signed certificate with an expiry date set after April 30th 2023. The internal certificate needs to be replaced using the steps in this KB. (Workaround Option 1 or Workaround Option 2 using the attached update_default_cert_v3.tar file.)
• Scenario 3: Environment is already using a custom certificate with an expiry date set after April 30th 2023. The internal certificate needs to be replaced using the steps in this Article.  (Workaround Option 1 or Workaround Option 2 using the attached update_default_cert_v3.tar file.)
• Scenario 4: Environment is using a VMware vRealize Lifecycle Manager generated certificate with an expiration date set after April 30th 2023. The internal certificate needs to be replaced using the steps in this KB. (Workaround Option 1 or Workaround Option 2 using the attached update_default_cert_v3.tar file.)
   

Quick Links:

• Prerequisites
  • Generate a self-signed certificate
• Workaround Option 1
• Workaround Option 2

Prerequisites

• Prior to proceeding, please preform a Guest Shutdown of all vRealize Log Insight nodes in the cluster and take snapshots.
• The update_default_cert.sh script attached to this article has been tested and validated on all supported versions of vRealize Log Insight.  If the environment is running a version that is passed its EOGs date, then please upgrade to a supported version before executing the script.  Refer to the Lifecycle Matrix for a list of supported versions.
• The workaround assumes that the SSL certificate is already updated from the default self-signed certificate to a custom, or a new self-signed certificate, with an expiration date later than April 30 2023.  This can be checked via a browser pointed to the vRealize Log Insight instance as noted in the Symptoms section.

Generate a self-signed certificate

1. Log into the Primary node as root via SSH or Console.
2. Run the following command to generate a self-signed certificate:

3. Run the following command to concatenate the key and certificate into a pem file

4. Using an SCP utility like WinSCP, connect to the primary node as root, and download the /tmp/cert.pem file to your desktop.
5. Log into the vRealize Log Insight UI as the local admin, expand the main menu and navigate to Configuration > SSL.
6. Click Choose File, browse to the cert.pem file downloaded from step 4 and click Open.
7. Click Save. This will automatically distribute the new certificate across all nodes in the vRealize Log Insight cluster.  Wait for the SSL certificate to be updated.
8. Refresh the vRealize Log Insight UI and validate whether the new certificate was applied via the browser.

• After you either have a self-signed certificate in place by following the above steps, or you have implemented a CA cert, with an expiration date later than April 30 2023, proceed to copy the update_default_cert_v3.tar file attached to this article on the right under the Attachments section to your vRealize Log Insight node(s).

1. Download then copy the update_default_cert_v3.tar file to the /root directory using an SCP utility like WinSCP.
2. Log into the vRealize Log Insight node as root via SSH or Console.
3. Run the following command to extract the tar file:

4. Run the following command to update the permissions of the script:

5. Repeat steps 1-4 for all nodes in the vRealize Log Insight cluster.

Workaround Option 1

This option requires a simultaneous restart of all of the nodes, which is faster but doesn't guarantee ingestion and UI HA through VIP(s) during the procedure.

For each vRealize Log Insight node, complete the following:

1. Log into the vRealize Log Insight node as root via SSH or Console.
2. Run the following command to navigate to the root directory:

3. Run the following command on all nodes to execute the script with the --all option:

4. Once completed on all of the nodes, stop the loginsight service on all of the nodes by running the following command:

5. Start the loginsight service on all of the nodes by running the following command:

Examples:

Current certificate does not have SSL client purpose
Please upload a new one from UI and retry

Workaround Option 2

Stage 1

1. Log into the vRealize Log Insight node as root via SSH or Console.
2. Run the following command to navigate to the root directory:

3. Run the following command to execute the script with the --stage1 option:

4. Run the following command to restart the loginsight service and wait until it's up and running before proceeding to the next node:

Examples:

Stage 2

1. Log into the vRealize Log Insight node as root via SSH or Console.
2. Run the following command to navigate to the root directory:

cd /root

3. Run the following command to execute the script with the --stage2 option:

./update_default_cert.sh --stage2

4. Run the following command to restart the loginsight service and wait until it's up and running before proceeding to the next node:

systemctl restart loginsight

Examples:

Note: If you receive the following output from running the script, you must generate and apply a certificate including the ClientAuth extended key usage as previously described in this article, and then re-attempt the workaround.

Current certificate does not have SSL client purpose
Please upload a new one from UI and retry

Verifying the Workaround

1. Log into the vRealize Log Insight node as root via SSH or Console.
2. Run the following command to navigate to the root directory:

3. Run the command below to execute the script with the verify option:

./update_default_cert.sh --verify

Example:

4. Alternatively, you can run the following command to validate that the new certificate is in place: