Return
-
Title
Certificates does not conform to algorithm constraints. Also Ensure that the VC is using a 1024-bit public key or longer and MD5 is not used -
Description
After upgrading to Foglight Management Server (FMS) 5.7.1 and VMWare 5.6.14, the VMWare agent is now failing to connect to the vCenter with the following error:
Certificates does not conform to algorithm constraints
Also you may get this other message while adding a new vCenter agent:Virtual Center connection failed vCenter.domain.com:443Ensure that the VC is using a 1024-bit public key or longer and MD5 is not used. -
Cause
The vCenter is configured to use 512-bit long certificate key. The JRE on the Foglight Management Server (FMS) has been updated to version 1.7.0.40 (1.7u40) or higher which restricts certificate keys which are less than 1024. -
Resolution
WORKAROUND:
If you are not able to use 1024 bit on the vCenter, you can perform the following workaround.
- Navigate to the <FMS HOME>/jre/lib/security/ (if FglAM is embeded) or <FglAM HOME>/jre/lib/security if FglAM is external.
- Edit the java.security file
- Edit the line as follows:
From:
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
To:
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 256
- Restart Foglight service or Daemon, then try again.
NOTE: It is recommended to configure the vCenter with stronger keys instead of the above workaround. For more information please refer to Java SE Development Kit 7, Update 40 (JDK 7u40).
STATUS:
Defect ID FDOC-7201 has been raised to clearly state this requirement and the workaround in the Cartridge for VMWare Release Notes.
-
Defect ID
FDOC-7201