Network Management

last person joined: 2 days ago 

Keep an informative eye on your network with HPE Aruba Networking network management solutions
Back to discussions
Expand all | Collapse all

VisualRF communication time out

This thread has been viewed 2 times

  • 1.  VisualRF communication time out

    Posted Aug 29, 2016 06:13 AM

    I have new Airwave 8.2.1.1 server running. I tried to enable VisualRF but it does not start. I went to dig some logs and found this kind of errors from /var/log/visualrf/visualrf.log : 

     

    2016-08-29 12:59:48,322 ERROR Inventory    com.airwave.svg.AmpInventoryServiceImpl Service [Inventory] is shutting down due to the error[sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
2016-08-29 12:59:48,322 ERROR Inventory    com.airwave.svg.AmpInventoryServiceImpl run
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

    These are repeating constantly. And rest is non-sense Java log diarrhea. 

     

    I suspect this is because I installed our own RapidSSL wildcard certificate on Airwave and this is either failing on wildcard or Java doesn't trust some intermediate CA on RapidSSL chain. I was thinking that I could try to check/insert CA:s to Javas keystore, but where is the keystore file VisualRF Java uses located?



  • 2.  RE: VisualRF communication time out
    Best Answer

    EMPLOYEE
    Posted Aug 29, 2016 06:19 AM

    Please open a TAC case ASAP.



  • 3.  RE: VisualRF communication time out

    Posted Aug 29, 2016 06:38 AM

    OK, TAC case has been opened



  • 4.  RE: VisualRF communication time out

    Posted Sep 06, 2016 03:50 AM

    We had GotoMeeting session with Aruba support. Problem was that I had installed my custom cert only for Pound revese proxy service and not for Apache. It seems that VisualRF runs on separate process which takes certs from different location than Pound. 

     

    Offical installation instructions are here: https://arubanetworkskb.secure.force.com/pkb/articles/FAQ/How-to-install-your-own-certificate-on-AMP-versions-7-2-4-and-greater

     

    Short simplified version would be, assuming that you import private key and certificate from elsewhere:

    - Create dir /var/airwave/custom/ssl-certs/

    - Import your private key and certificate as separate files into that dir, name them newcert.crt (certificate) and newcert_private.key (private key)

    - Follow KB instructions from step 2

    2. Concatenate your certificate and private key into one file, to be used by pound. Add a new line to the end of the certificate to ensure that the two files don't get jumbled together during the concatenation. 

# echo -e "
    " >> /var/airwave/custom/ssl-certs/newcert.crt 
# cat /var/airwave/custom/ssl-certs/newcert.crt /var/airwave/custom/ssl-certs/newcert_private.key > /var/airwave/custom/ssl-certs/pound.crt 

3. Modify the symbolic (soft) links in the default directories to point to your new certificate and private key files: 

# ln -sf /var/airwave/custom/ssl-certs/newcert.crt /etc/httpd/conf/ssl.crt/server.crt 
# ln -sf /var/airwave/custom/ssl-certs/newcert_private.key /etc/httpd/conf/ssl.key/server.key 
# ln -sf /var/airwave/custom/ssl-certs/pound.crt /etc/httpd/conf/ssl.pem 


4. Restart the Apache and pound web servers: 

# ra 
# service pound restart