ALM-46011 MOTService Certificate File Has Expired

Alarm Description

The system checks whether the certificate file in the system has expired on the hour. This alarm is generated when the certificate file has expired.

This alarm is cleared when a valid certificate is imported and the alarm detection mechanism is triggered on the next hour.

Alarm Attributes

Alarm ID	Alarm Severity	Alarm Type	Service Type	Auto Cleared
46011	Major	Security	MOTService	Yes

Alarm Parameters

Type	Parameter	Description
Location Information	Source	Specifies the cluster or system for which the alarm was generated.
	ServiceName	Specifies the service for which the alarm was generated.
	RoleName	Specifies the role for which the alarm was generated.
	HostName	Specifies the host for which the alarm was generated.
Additional Information	Trigger Condition	Specifies the threshold for triggering the alarm.

Impact on the System

If the MOTService certificate has expired, some MOTService functions such as data import and query cannot be provided for upper-layer services.

Possible Causes

The MOTService certificate file (MOTService root certificate or MOTService user certificate) has expired.

Handling Procedure

Locate the alarm cause.

Log in to FusionInsight Manager and choose O&M > Alarm > Alarms. In the right pane, locate this alarm and click .

View Additional Information to obtain the additional information about the alarm.
- If MOTService HA root Certificate is displayed in the additional information, view Location to obtain the name of the host for which the alarm is generated. Then, log in to the host as user omm and go to 2.
- If MOTService HA server Certificate is displayed in the additional information, view Location to obtain the name of the host for which the alarm is generated. Then, log in to the host as user omm and go to 3.
- If MOTService root Certificate is displayed in the additional information, view Location to obtain the name of the host for which the alarm is generated. Then, log in to the host as user omm and go to 4.
- If MOTService server Certificate is displayed in the additional information, view Location to obtain the name of the host for which the alarm is generated. Then, log in to the host as user omm and go to 5.

Check the validity period of the certificate files in the system.

Check whether the current system time is within the validity period of the MOTService HA root certificate.

Run the openssl x509 -noout -text -in ${MOTSERVER_HOME}/ha/local/cert/root-ca.crt command to check the effective time and due time of the MOTService HA root certificate.
- If yes, go to 8.
- If no, go to 6.
Check whether the current system time is within the validity period of the MOTService HA user certificate.

Run the openssl x509 -noout -text -in ${MOTSERVER_HOME}/ha/local/cert/server.crt command to check the effective time and due time of the MOTService HA user certificate.
- If yes, go to 8.
- If no, go to 6.
Check whether the current system time is within the validity period of the MOTService root certificate.

Run the openssl x509 -noout -text -in ${MOTSERVER_HOME}/security/root-ca.crt command to check the effective time and due time of the MOTService root certificate.
- If yes, go to 8.
- If no, go to 7.
Check whether the current system time is within the validity period of the MOTService user certificate.

Run the openssl x509 -noout -text -in ${MOTSERVER_HOME}/security/server.crt command to check the effective time and due time of the MOTService user certificate.
- If yes, go to 8.
- If no, go to 7.

The following is an example of the effective time and due time of a certificate:

Certificate: 
    Data: 
        Version: 3 (0x2) 
        Serial Number: 
            97:d5:0e:84:af:ec:34:d8 
        Signature Algorithm: sha256WithRSAEncryption 
        Issuer: C=CN, ST=xxx, L=yyy, O=zzz, OU=IT, CN=HADOOP.COM 
        Validity 
            Not Before: Dec 13 06:38:26 2016 GMT             // Effective time
            Not After : Dec 11 06:38:26 2026 GMT             // Due time

Import certificate files.

Import a new MOTService HA certificate file.

Apply for or generate a new MOTService HA certificate file and import it to the system. The alarm is automatically cleared after the MOTService HA certificate is imported. Check whether this alarm is reported again during periodic check.
- If yes, go to 8.
- If no, no further action is required.
Import a new MOTService certificate file.

Apply for or generate a new MOTService certificate file and import it to the system. The alarm is automatically cleared after the MOTService certificate is imported. Check whether this alarm is reported again during periodic check.
- If yes, go to 8.
- If no, no further action is required.

Collect fault information.

On FusionInsight Manager, choose O&M. In the navigation pane on the left, choose Log > Download.
Expand the Service drop-down list, select Controller, OmmServer, OmmCore, and Tomcat, and click OK.
Click the edit icon in the upper right corner, and set Start Date and End Date for log collection to 10 minutes ahead of and after the alarm generation time, respectively. Then, click Download.
Contact O&M personnel/Technical support and provide the collected logs.