You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "anjanahkarthic (via GitHub)" <gi...@apache.org> on 2024/07/31 10:14:30 UTC
[D] template download failedfrom AWS s3 bucket [cloudstack]
GitHub user anjanahkarthic created a discussion: template download failedfrom AWS s3 bucket
we upgraded the ACS to new version and live patched the system VM. Then we attempted to launch a template in Apache CloudStack using a link stored in an AWS S3 bucket. While the template downloads successfully in a browser, it fails to download in CloudStack using the same link. The error displayed was: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target."
~~~
2024-07-31 13:04:15,686 WARN [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) alertType=[28] dataCenterId=[1] podId=[null] clusterId=[null] message=[Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 WARN [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) No recipients set in global setting 'alert.email.addresses', skipping sending alert with subject [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] and content [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 ERROR [o.a.c.s.i.BaseImageStoreDriverImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
~~~
GitHub link: https://github.com/apache/cloudstack/discussions/9472
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] template download failedfrom AWS s3 bucket [cloudstack]
Posted by "anjanahkarthic (via GitHub)" <gi...@apache.org>.
GitHub user anjanahkarthic closed a discussion: template download failedfrom AWS s3 bucket
we upgraded the ACS to new version and live patched the system VM. Then we attempted to launch a template in Apache CloudStack using a link stored in an AWS S3 bucket. While the template downloads successfully in a browser, it fails to download in CloudStack using the same link. The error displayed was: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target."
~~~
2024-07-31 13:04:15,686 WARN [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) alertType=[28] dataCenterId=[1] podId=[null] clusterId=[null] message=[Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 WARN [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) No recipients set in global setting 'alert.email.addresses', skipping sending alert with subject [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] and content [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 ERROR [o.a.c.s.i.BaseImageStoreDriverImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
~~~
GitHub link: https://github.com/apache/cloudstack/discussions/9472
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] template download failedfrom AWS s3 bucket [cloudstack]
Posted by "anjanahkarthic (via GitHub)" <gi...@apache.org>.
GitHub user anjanahkarthic added a comment to the discussion: template download failedfrom AWS s3 bucket
I used the public AWS S3 bucket link over HTTPS to download the template. After upgrading ACS to a newer version and live-patching the system VM, I encountered a certificate issue when attempting to download the template. The error displayed was: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target."
It appears that the SSL certificate keystore was not updated during the live patching of the secondary storage VM. By deleting the old VM and launching a new one with the latest system VM 4.19.1 template, the certificate keystore was updated, and I can now successfully download the template.
It would be beneficial to update the SSL certificate keystore during system VM live patching.
GitHub link: https://github.com/apache/cloudstack/discussions/9472#discussioncomment-10228946
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] template download failedfrom AWS s3 bucket [cloudstack]
Posted by "kiranchavala (via GitHub)" <gi...@apache.org>.
GitHub user kiranchavala added a comment to the discussion: template download failedfrom AWS s3 bucket
@anjanahkarthic
are you download the template from the ssvm
example get a presinged s3 URL for the object
http://10.0.32.251:9000/kiran-bucket2/kvm.qcow2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20240802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240802T050929Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=39e16a5ffd7bea25a62f11c9f39ae6153d809fb82f936a9baa1ef54887a76909
Login to the ssvm and do a curl
example
curl -o test.qcow2 "http://10.0.32.251:9000/kiran-bucket2/kvm.qcow2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20240802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240802T050929Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=39e16a5ffd7bea25a62f11c9f39ae6153d809fb82f936a9baa1ef54887a76909"
GitHub link: https://github.com/apache/cloudstack/discussions/9472#discussioncomment-10219672
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org