How to solve curl to vcenter URL causes "SSL certificate problem: unable to get local issuer certificate" error in Openshift 4 on Vsphere
Issue
- Post installation of OCP 4 cluster on Vshpere found storage cluster operator in degraded:
omc get co | grep storage
NAME VERSION AVAILABLE PROGRESSING DEGRADED SINCE
storage 4.13.4 True True True 1d
- Further looking storage cluster operator logs, we can see connection to vcenter has been timeout.
"message": "DefaultStorageClassControllerAvailable: StorageClass provided by supplied CSI Driver instead of the cluster-storage-operator\nVSphereCSIDriverOperatorCRAvailable: All is well\nVSphereProblemDetectorControllerAvailable: failed to connect to vcenter01.xxx.xxxx.com: Post \"https://vcenter01.xxx.xxxx.com/sdk\": dial tcp 192.168.x.xx:443: i/o timeout",
- While connecting to the vcenter from the installer/bastion server or from all master nodes.
sh-4.4# curl -v https://vcenter01.xxx.xxxx.com
* Rebuilt URL to: https://vcenter01.xxx.xxxx.com/
* Trying 192.168.0.29...
* TCP_NODELAY set
* Connected to vcenter01.xx.xxxx.com (192.168.x.x) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
Environment
- Red Hat OpenShift Container Platform (RHOCP) 4
- OCP on VMware vSphere
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.