You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cloudstack.apache.org by "KuasarCloud (via GitHub)" <gi...@apache.org> on 2025/01/26 00:41:03 UTC
[D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
GitHub user KuasarCloud created a discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Hey team,
Is there a procedure to renew Hyp VNC TLS Cert? My Proxy Console VM gets this error when accessing the VNC Server
```shell
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,683 INFO NoVncClient:65 - Connecting to VNC server xxxxx:5950 ...
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,742 INFO VncTLSSecurity:65 - Processing VNC TLS security
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,743 INFO Link:415 - Conf file found: /usr/local/cloud/systemvm/conf/agent.properties
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: Exception in thread "Thread-480" com.cloud.utils.exception.CloudRuntimeException: javax.net.ssl.SSLHandshakeException: NotAfter: Tue Aug 06 19:04:44 UTC 2024
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.vnc.security.VncTLSSecurity.process(VncTLSSecurity.java:96)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.vnc.NoVncClient.processHandshakeSecurityType(NoVncClient.java:518)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakeSecurityResult(ConsoleProxyNoVncClient.java:209)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakePhase(ConsoleProxyNoVncClient.java:203)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateVNCServerThroughNioSocket(ConsoleProxyNoVncClient.java:231)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateToVNCServer(ConsoleProxyNoVncClient.java:188)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient$1.run(ConsoleProxyNoVncClient.java:107)
```
Thanks
GitHub link: https://github.com/apache/cloudstack/discussions/10275
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "jhuijbrechts (via GitHub)" <gi...@apache.org>.
GitHub user jhuijbrechts added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Maybe by default set this to a bigger time? As it seems to be a common issue, I had the same issue, as well as the person in the original issue.
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11962707
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
This looks same as #9718
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11956430
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "KuasarCloud (via GitHub)" <gi...@apache.org>.
GitHub user KuasarCloud added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Something curious about the error is that older vms are having the problem not the new ones
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11955720
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "KuasarCloud (via GitHub)" <gi...@apache.org>.
GitHub user KuasarCloud added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Thanks @weizhouapache for your reply, after reading the article I have couple doubts
1. The error says -> **NotAfter: Tue Aug 06 19:04:44 UTC 2024** but the cloud.crt in the Hyp is not expired -> **notAfter=Jul 22 19:35:30 2025 GMT** because **ca.framework.cert.automatic.renewal** is enabled
2. The weird thing here is that for old vms the NoVNC is not working but for recently created ones is working, do I have to restart the libvirtd daemon? If I do it will reboot my vms? I guess no but want to be sure as this is a prod env.
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11957715
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "KuasarCloud (via GitHub)" <gi...@apache.org>.
GitHub user KuasarCloud added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Thanks @weizhouapache
For what purpose? restart libvirtd? or not use this Hyp?
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11958806
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
> Thanks @weizhouapache for your reply, after reading the article I have couple doubts
>
> 1. The error says -> **NotAfter: Tue Aug 06 19:04:44 UTC 2024** but the cloud.crt in the Hyp is not expired -> **notAfter=Jul 22 19:35:30 2025 GMT** because **ca.framework.cert.automatic.renewal** is enabled
> 2. The weird thing here is that for old vms the NoVNC is not working but for recently created ones is working, do I have to restart the libvirtd daemon? If I do it will reboot my vms? I guess no but want to be sure as this is a prod env.
you can migrate the vms
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11958757
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
> Maybe by default set this to a bigger time? As it seems to be a common issue, I had the same issue, as well as the person in the original issue.
yes, the default value 365 is too small.
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11962799
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
GitHub user weizhouapache added a comment to the discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
the new vm (qemu process) will use the new cert
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-11958840
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "KuasarCloud (via GitHub)" <gi...@apache.org>.
GitHub user KuasarCloud closed a discussion: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
Hey team,
Is there a procedure to renew Hyp VNC TLS Cert? My Proxy Console VM gets this error when accessing the VNC Server
```shell
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,683 INFO NoVncClient:65 - Connecting to VNC server xxxxx:5950 ...
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,742 INFO VncTLSSecurity:65 - Processing VNC TLS security
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,743 INFO Link:415 - Conf file found: /usr/local/cloud/systemvm/conf/agent.properties
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: Exception in thread "Thread-480" com.cloud.utils.exception.CloudRuntimeException: javax.net.ssl.SSLHandshakeException: NotAfter: Tue Aug 06 19:04:44 UTC 2024
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.vnc.security.VncTLSSecurity.process(VncTLSSecurity.java:96)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.vnc.NoVncClient.processHandshakeSecurityType(NoVncClient.java:518)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakeSecurityResult(ConsoleProxyNoVncClient.java:209)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakePhase(ConsoleProxyNoVncClient.java:203)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateVNCServerThroughNioSocket(ConsoleProxyNoVncClient.java:231)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateToVNCServer(ConsoleProxyNoVncClient.java:188)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: at com.cloud.consoleproxy.ConsoleProxyNoVncClient$1.run(ConsoleProxyNoVncClient.java:107)
```
Thanks
GitHub link: https://github.com/apache/cloudstack/discussions/10275
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org
Re: [D] VncTLSSecurity Error when VM Console Proxy connects to Hypervisor [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
GitHub user DaanHoogland closed the discussion with a comment: VncTLSSecurity Error when VM Console Proxy connects to Hypervisor
closed this for lack of interaction, please reopen or open a new item if applicable
GitHub link: https://github.com/apache/cloudstack/discussions/10275#discussioncomment-12995379
----
This is an automatically sent email for users@cloudstack.apache.org.
To unsubscribe, please send an email to: users-unsubscribe@cloudstack.apache.org