ALM-12054 Invalid Certificate File (For MRS 2.x or Earlier)

Description

The system checks whether the certificate file is invalid (has expired or is not yet valid) on 23:00 every day. This alarm is generated when the certificate file is invalid.

This alarm is cleared when the status of the newly imported certificate is valid.

Attribute

Parameters

Impact on the System

The system reminds users that the certificate file is invalid. If the certificate file is invalid, some functions are restricted and cannot be used properly.

Possible Causes

No certificate (HA root certificate or HA user certificate) is imported to the system, the certificate fails to be imported, or the certificate file is invalid.

Procedure

Check the alarm cause.

1. Go to the MRS cluster details page and choose Alarms.
2. In the real-time alarm list, click the row that contains the alarm.

   In the Alarm Details area, view the additional information about the alarm.

   • If CA Certificate is displayed in the additional alarm information, use PuTTY to log in to the active OMS management node as user omm and go to 3.
   • If HA root Certificate is displayed in the additional information, check Location to obtain the name of the host involved in this alarm. Then use PuTTY to log in to the host as user omm and go to 4.
   • If HA server Certificate is displayed in the additional information, check Location to obtain the name of the host involved in this alarm. Then use PuTTY to log in to the host as user omm and go to 5.

Check the validity period of the certificate files in the system.

3. Check whether the current system time is in the validity period of the CA certificate.

   Run the openssl x509 -noout -text -in ${CONTROLLER_HOME}/security/cert/root/ca.crt command to check the effective time and due time of the root certificate.

   • If yes, go to 8.
   • If no, go to 6.

4. Check whether the current system time is in the validity period of the HA root certificate.

   Run the openssl x509 -noout -text -in ${CONTROLLER_HOME}/security/certHA/root-ca.crt command to check the effective time and due time of the HA root certificate.

   • If yes, go to 8.
   • If no, go to 7.

5. Check whether the current system time is in the validity period of the HA user certificate.

   Run the openssl x509 -noout -text -in ${CONTROLLER_HOME}/security/certHA/server.crt command to check the effective time and due time of the HA user certificate.

   • If yes, go to 8.
   • If no, go to 7.

     The following is an example of the effective time and expiration time of a CA or HA certificate:

     Certificate: 
         Data: 
             Version: 3 (0x2) 
             Serial Number: 
                 97:d5:0e:84:af:ec:34:d8 
             Signature Algorithm: sha256WithRSAEncryption 
             Issuer: C=CountryName, ST=State, L=Locality, O=Organization, OU=IT, CN=HADOOP.COM 
             Validity 
                 Not Before: Dec 13 06:38:26 2016 GMT             // Effective time
                 Not After : Dec 11 06:38:26 2026 GMT             // Expiration time

Import certificate files.

6. Import a new CA certificate file.

   Contact O&M personnel to apply for or generate a new CA certificate file and import it. Manually clear the alarm and check whether this alarm is generated again during periodic check.

   

   If the Ranger certificate has expired, see How Do I Update the Ranger Certificate? to rectify the fault.

   • If yes, go to 8.
   • If no, no further action is required.

7. Import a new HA certificate file.

   Apply for or generate a new HA certificate file and import it by referring to Replacing an HA Certificate. Manually clear the alarm and check whether this alarm is generated again during periodic check.

   • If yes, go to 8.
   • If no, no further action is required.

8. Collect fault information.
   1. On MRS Manager, choose System > Export Log.
   2. Contact the O&M engineers and send the collected logs.

Reference

For details about how to handle an expired OBS certificate, see Expired OBS Certificate in a Cluster.