Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have a vcloud cell with 2 IPs on 2 NICs, one is for HTTP which has a CA signed ssl cert and the consoleproxy which has a self signed cert. when I connect internally from the network to a console, it connects with no issues, but when I connect from externally (outside the firewall, I get SSL errors, and I cannot connect. Below is a copy of the error.

From the outside, they connect to an ASA, which NATs it to a netscaler, which passes it thru to the vcloud director server. I am not sure of how to resolve the issue so I can connect thru and bypass the SSL error.

2013-01-28T14:56:20.433-05:00| vmrc| I120: vmClientCore::RunEmbeddedVMRC: eventName = "VMRC_EVENT_vmrc-np-t-{BAB273CD-AAC3-48B1-B390-42CB7677F666}", monikerName = "VMRC_MONIKER_vmrc-np-t-{BAB273CD-AAC3-48B1-B390-42CB7677F666}", monikerEvent = 3F8
2013-01-28T14:56:20.433-05:00| vmrc| W110: IMonikerImpl::vmClientCore::MonikerImpl<class vmClientCore::InvokeMgrDisp>::GetTimeOfLastChange invoked
2013-01-28T14:56:20.443-05:00| vmrc| I120: HOSTINFO 4301113729300 @ 2727578Hz -> 0 @ 1000000000Hz
2013-01-28T14:56:20.443-05:00| vmrc| I120: HOSTINFO ((x * 3075478684) >> 23) + -1576898526182400
2013-01-28T14:56:21.193-05:00| vmrc| I120: Setting proxy environment variable: "VMWARE_HTTPSPROXY="
2013-01-28T14:56:21.193-05:00| vmrc| I120: cui::vmrc::VMCnx::Connect: Connect to MOID "vm-194" on "vmrc.domain.gov"
2013-01-28T14:56:21.193-05:00| vmrc| I120: Resolving IP address for hostname vmrc.domain.gov
2013-01-28T14:56:21.193-05:00| vmrc| I120: Resolved to 111.111.111.111
2013-01-28T14:56:21.303-05:00| vthread-3| I120: VTHREAD initialize thread 3 "vthread-3" host id 2544
2013-01-28T14:56:21.323-05:00| vmrc| W110: SSL_IsVerifyEnabled: failed to open the product registry key. Falling back to default behavior: verification on. LastError = 0
2013-01-28T14:56:21.423-05:00| vmrc| I120: CertificateCheck::CheckCertEmbedded: allowSSLErrors: true
2013-01-28T14:56:21.423-05:00| vmrc| I120: CertificateCheck::CheckCertEmbedded: Found the following errors for vmrc.domain.gov's SSL certificate: {
2013-01-28T14:56:21.423-05:00| vmrc| I120:   - 2
2013-01-28T14:56:21.423-05:00| vmrc| I120:   - The host name used for the connection does not match the subject name on the host certificate.
2013-01-28T14:56:21.433-05:00| vmrc| I120: }
2013-01-28T14:56:21.433-05:00| vmrc| I120: cui::CertificateCheck::CheckCertEmbedded - SSL verification failure for "vmrc.domain.gov" due to a host thumbprint mismatch: stored thumbprint "66:6f:d0:92:b4:c0:54:fc:6b:64:0f:bf:48:87:22:6b:3a:4d:ae:aa" does not match cert thumbprint "A4:7C:0A:D5:EF:B1:10:F0:E4:91:43:BA:62:35:47:19:05:11:49:bb".
2013-01-28T14:56:21.433-05:00| vmrc| I120: cui::vmrc::DlgMgrImpl: "SSL verification failure for "vmrc.domain.gov" due to a host thumbprint mismatch: stored thumbprint "66:6f:d0:92:b4:c0:54:fc:6b:64:0f:bf:48:87:11:6b:3a:4d:ae:11" does not match cert thumbprint "A4:7C:0A:D5:EF:B1:10:F0:E4:91:43:BA:62:11:47:19:05:22:49:22"."
2013-01-28T14:56:21.453-05:00| vmrc| I120: cui::vmrc::VMCnx::OnConnectAborted: Connect cancelled for MOID "vm-194" on "vmrc.domain.gov"
2013-01-28T14:56:21.453-05:00| vmrc| I120: cui::vmrc::VMCnxMgr::EmitConnectionStateSignal: Emitting "disconnected" signal (requested) for MOID "vm-194" on "vmrc.domain.gov" - reason 'An error occurred that affected the security of the connection'
2013-01-28T14:56:41.683-05:00| vmrc| I120: Clean exit
share|improve this question
    
I looked at the cert and i figured out what is going on. I have a root cert from the clients CA in the keystore along with the HTTP (signed cert) and the consoleproxy which is selfsigned. I get a thumbprint mismatch error now. is there a way to do this without actually verifying that? or do I need a signed cert for the consoleproxy as well? –  Drew Jan 29 '13 at 14:19
    
CertificateCheck::CheckCertEmbedded - SSL verification failure for "vmrc.domain.gov" due to a host thumbprint mismatch: stored thumbprint "the thumbprint" does not match cert thumbprint "the thumbprint". "SSL verification failure for "vmrc.domain.gov" due to a host thumbprint mismatch: stored thumbprint "the thumbprint" does not match cert thumbprint "the thumbprint" Connect cancelled for MOID vm-194 on "vmrc.domain." EmitConnectionStateSignal: Emitting "disconnected" signal (requested) for MOID "vm-194" on "vmrc.domain."-reason 'An error occurred that affected the security of the connection' –  Drew Jan 29 '13 at 14:22
    
thats the new log edited down so it would fit. –  Drew Jan 29 '13 at 14:24
    
wondering if I can use a self signed cert along with the signed cert in the same keystore. i mightneed to get a signed cert for that connection as well, but I am hoping not to. –  Drew Jan 29 '13 at 14:53
    
i figured it out - cant use a self signed cert with a signed cert. gotta do 2 signed certs. –  Drew Jan 29 '13 at 20:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.