本記事は古いIBM CloudのVCS環境(vSphere 6.5ベース)を順次最新化してますにおける作業の一環である。
1. はじめに
久しくアクセスしていなかったIBM Cloudで作成したVCS環境のvCenter 6.5にアクセスすると以下のようなエラーが発生していたので復旧させるまでの手順例をまとめた。
なお、今回とは直接関係ないが、パスワードの期限が切れないように、あらかじめvCenterのパスワード(rootなど)を無期限化する方法に従って無期限化しておいた。。
2. VMware Security Token Service (STS)証明書の確認
ズバリ、VMware Security Token Service (STS)証明書が切れているのが原因だと思われた（参考記事）。
ここの手順に従って確認したところ、やはり証明書が切れていた。
バージョン確認
Command> system.version.get
Version:
Product: VMware vCenter Server Appliance
Installtime: 2019-07-08T18:44:10 UTC
Summary: Patch for VMware vCenter Server Appliance 6.5.0
Releasedate: May 14, 2019
Version: 6.5.0.24000
Build: 13638625
Type: vCenter Server with an embedded Platform Services Controller
VMware Security Token Service (STS) 証明書の有効期限確認
Command> shell.set --enabled true
Command> shell
root@vcenter-vcs65 [ ~ ]# cd /tmp
root@vcenter-vcs65 [ /tmp ]# python checksts.py
1 VALID CERTS
================
LEAF CERTS:
None
ROOT CERTS:
[] Certificate C2:4F:A5:A7:EA:6B:8C:EC:C0:66:93:1F:51:8A:5E:3E:5D:FD:EE:C9 will expire in 2538 days (6.0 years).
1 EXPIRED CERTS
================
LEAF CERTS:
[] Certificate: 48:DE:B3:EC:44:44:86:9D:C6:59:B2:84:FC:62:37:95:34:9E:BD:C8 expired on 2021-07-07 18:27:24 GMT!
ROOT CERTS:
None
WARNING!
You have expired STS certificates. Please follow the KB corresponding to your OS:
VCSA: https://kb.vmware.com/s/article/76719
Windows: https://kb.vmware.com/s/article/79263
3. Administrator@vsphere.localパスワードの初期化
STS証明書を更新するためには、Administrator@vsphere.localのパスワードを入力する必要があるが、このパスワードもわからなくなっていたので、初期化を最初に行なった。
Administrator@vsphere.localパスワードの初期化
root@vcenter-vcs65 [ ~ ]# /usr/lib/vmware-vmdir/bin/vdcadmintool
==================
Please select:
0. exit
1. Test LDAP connectivity
2. Force start replication cycle
3. Reset account password
4. Set log level and mask
5. Set vmdir state
6. Get vmdir state
7. Get vmdir log level and mask
==================
3
Please enter account UPN : Administrator@vsphere.local
New password is -
*****************
==================
Please select:
0. exit
4. STS証明書の再生成
以下のKBを参照した。
https://kb.vmware.com/s/article/76719
STS証明書の再作成
root@vcenter-vcs65 [ /tmp ]# chmod +x fixsts.sh
root@vcenter-vcs65 [ /tmp ]# ./fixsts.sh
NOTE: This works on external and embedded PSCs
This script will do the following
1: Regenerate STS certificate
What is needed?
1: Offline snapshots of VCs/PSCs
2: SSO Admin Password
IMPORTANT: This script should only be run on a single PSC per SSO domain
==================================
Resetting STS certificate for vcenter-vcs65.vcs65.ibm.local started on Thu Jul 21 02:15:47 UTC 2022
Detected DN: cn=vcenter-vcs65.vcs65.ibm.local,ou=Domain Controllers,dc=vsphere,dc=local
Detected PNID: vcenter-vcs65.vcs65.ibm.local
Detected PSC: vcenter-vcs65.vcs65.ibm.local
Detected SSO domain name: vsphere.local
Detected Machine ID: 911b6d37-5416-4c9b-8c9c-128abf2ebd52
Detected IP Address: 10.193.73.2
Domain CN: dc=vsphere,dc=local
==================================
==================================
Detected Root's certificate expiration date: 2029 Jul 2
Detected today's date: 2022 Jul 21
==================================
Exporting and generating STS certificate
Status : Success
Using config file : /tmp/vmware-fixsts/certool.cfg
Status : Success
Enter password for administrator@vsphere.local:
Highest tenant credentials index : 1
Exporting tenant 1 to /tmp/vmware-fixsts
Deleting tenant 1
Highest trusted cert chains index: 1
Exporting trustedcertchain 1 to /tmp/vmware-fixsts
Deleting trustedcertchain 1
Applying newly generated STS certificate to SSO domain
adding new entry "cn=TenantCredential-1,cn=vsphere.local,cn=Tenants,cn=IdentityManager,cn=Services,dc=vsphere,dc=local"
adding new entry "cn=TrustedCertChain-1,cn=TrustedCertificateChains,cn=vsphere.local,cn=Tenants,cn=IdentityManager,cn=Services,dc=vsphere,dc=local"
Replacement finished - Please restart services on all vCenters and PSCs in your SSO domain
==================================
IMPORTANT: In case you're using HLM (Hybrid Linked Mode) without a gateway, you would need to re-sync the certs from Cloud to On-Prem after following this procedure
==================================
==================================
これで、STS証明書で期限切れのものは無くなった。
VMware Security Token Service (STS) 証明書の有効期限確認
root@vcenter-vcs65 [ /tmp ]# python checksts.py
2 VALID CERTS
================
LEAF CERTS:
[] Certificate 2A:7F:FD:19:1B:DA:69:4B:4F:95:42:60:C4:05:9A:D8:6E:3E:45:14 will expire in 730 days (2.0 years).
ROOT CERTS:
[] Certificate C2:4F:A5:A7:EA:6B:8C:EC:C0:66:93:1F:51:8A:5E:3E:5D:FD:EE:C9 will expire in 2538 days (6.0 years).
0 EXPIRED CERTS
================
LEAF CERTS:
None
ROOT CERTS:
None
5. その他の証明書の再作成
https://kb.vmware.com/s/article/76719 によると、STS証明書を更新した後に以下のようにサービスを再起動するように書かれているが、エラーが発生してvpxd-svcsが起動しない。
サービスの再起動
root@vcenter-vcs65 [ /tmp ]# service-control --stop --all
root@vcenter-vcs65 [ /tmp ]# service-control --start --all
（エラーが出る。）
エラーの確認
root@vcenter-vcs65 [ /tmp ]# view /var/log/vmware/vpxd-svcs/vpxd-svcs.log
root@vcenter-vcs65 [ /tmp ]# service-control --start vpxd-svcs
Perform start operation. vmon_profile=None, svc_names=['vpxd-svcs'], include_coreossvcs=False, include_leafossvcs=False
2022-07-21T02:32:21.799Z Service vpxd-svcs state STOPPED
Error executing start on service vpxd-svcs. Details {
"resolution": null,
"detail": [
{
"args": [
"vpxd-svcs"
],
"id": "install.ciscommon.service.failstart",
"localized": "An error occurred while starting service 'vpxd-svcs'",
"translatable": "An error occurred while starting service '%(0)s'"
}
],
"componentKey": null,
"problemId": null
}
Service-control failed. Error {
"resolution": null,
"detail": [
{
"args": [
"vpxd-svcs"
],
"id": "install.ciscommon.service.failstart",
"localized": "An error occurred while starting service 'vpxd-svcs'",
"translatable": "An error occurred while starting service '%(0)s'"
}
],
"componentKey": null,
"problemId": null
}
上記KBにはサービスが起動しないならば他の証明書も有効期限切れになっているとのことだった。実際に、以下のスクリプトを実行すると、多くのものが期限切れになっていることがわかる。
証明書の有効期限チェック
root@vcenter-vcs65 [ /tmp ]# for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done
STORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
Not After : Jul 8 06:37:08 2021 GMT
STORE TRUSTED_ROOTS
Alias : c24fa5a7ea6b8cecc066931f518a5e3e5dfdeec9
Not After : Jul 2 18:37:08 2029 GMT
STORE TRUSTED_ROOT_CRLS
Alias : 3b417b2c774a383d165934a475d1da514620a4b3
STORE machine
Alias : machine
Not After : Jul 7 18:28:04 2021 GMT
STORE vsphere-webclient
Alias : vsphere-webclient
Not After : Jul 7 18:28:04 2021 GMT
STORE vpxd
Alias : vpxd
Not After : Jul 7 18:28:05 2021 GMT
STORE vpxd-extension
Alias : vpxd-extension
Not After : Jul 7 18:28:05 2021 GMT
STORE SMS
Alias : sms_self_signed
Not After : Jul 8 18:42:29 2029 GMT
以下で、証明書の再作成を行う。
証明書作成時に指定するVMCAとHostnameを確認
root@vcenter-vcs65 [ /tmp ]# /usr/lib/vmware-vmafd/bin/vmafd-cli get-pnid --server-name localhost
vcenter-vcs65.vcs65.ibm.local
root@vcenter-vcs65 [ /tmp ]# hostname -f
vcenter-vcs65.vcs65.ibm.local
root@vcenter-vcs65 [ /tmp ]# /usr/lib/vmware-vmca/bin/certificate-manager
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
| |
| *** Welcome to the vSphere 6.5 Certificate Manager *** |
| |
| -- Select Operation -- |
| |
| 1. Replace Machine SSL certificate with Custom Certificate |
| |
| 2. Replace VMCA Root certificate with Custom Signing |
| Certificate and replace all Certificates |
| |
| 3. Replace Machine SSL certificate with VMCA Certificate |
| |
| 4. Regenerate a new VMCA Root Certificate and |
| replace all certificates |
| |
| 5. Replace Solution user certificates with |
| Custom Certificate |
| |
| 6. Replace Solution user certificates with VMCA certificates |
| |
| 7. Revert last performed operation by re-publishing old |
| certificates |
| |
| 8. Reset all Certificates |
|_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _|
Note : Use Ctrl-D to exit.
Option[1 to 8]: 8
Do you wish to generate all certificates using configuration file : Option[Y/N] ? : Y
Please provide valid SSO and VC priviledged user credential to perform certificate operations.
Enter username [Administrator@vsphere.local]:
Enter password:
Please configure certool.cfg with proper values before proceeding to next step.
Press Enter key to skip optional parameters or use Default value.
Enter proper value for 'Country' [Default value : US] :
Enter proper value for 'Name' [Default value : CA] :
Enter proper value for 'Organization' [Default value : VMware] :
Enter proper value for 'OrgUnit' [Default value : VMware Engineering] :
Enter proper value for 'State' [Default value : California] :
Enter proper value for 'Locality' [Default value : Palo Alto] :
Enter proper value for 'IPAddress' (Provide comma separated values for multiple IP addresses) [optional] :
Enter proper value for 'Email' [Default value : email@acme.com] :
Enter proper value for 'Hostname' (Provide comma separated values for multiple Hostname entries) [Enter valid Fully Qualified Domain Name(FQDN), For Example : example.domain.com] : vcenter-vcs65.vcs65.ibm.local
Enter proper value for VMCA 'Name' :vcenter-vcs65.vcs65.ibm.local
Continue operation : Option[Y/N] ? : Y
You are going to reset by regenerating Root Certificate and replace all certificates using VMCA
Continue operation : Option[Y/N] ? : Y
Get site nameCompleted [Reset Machine SSL Cert...]
default-first-site
Lookup all services
Get service default-first-site:69ea8479-b97b-4821-8bec-5bfe1c981017
Update service default-first-site:69ea8479-b97b-4821-8bec-5bfe1c981017; spec: /tmp/svcspec_YoTQqw
Get service default-first-site:30a5a98a-3529-4447-8087-450bde741923
Update service default-first-site:30a5a98a-3529-4447-8087-450bde741923; spec: /tmp/svcspec_KDR_IQ
Get service default-first-site:c0112cac-7bd2-4673-acf9-5ca8212ab6cf
Update service default-first-site:c0112cac-7bd2-4673-acf9-5ca8212ab6cf; spec: /tmp/svcspec_GeE5Ke
Get service 43d9a74a-d37e-473e-bcca-568255457a5a
Update service 43d9a74a-d37e-473e-bcca-568255457a5a; spec: /tmp/svcspec_xhrI4m
Get service f56e5d8e-7e0d-4596-892a-5fe183259f3a
Update service f56e5d8e-7e0d-4596-892a-5fe183259f3a; spec: /tmp/svcspec_JnrQ0l
Get service 43160ce7-14e7-4926-bc7c-ddba20995ce3
Update service 43160ce7-14e7-4926-bc7c-ddba20995ce3; spec: /tmp/svcspec_My35_y
Get service a1e3cef1-a424-4397-a325-7c42714e2488
Update service a1e3cef1-a424-4397-a325-7c42714e2488; spec: /tmp/svcspec_AT9Nag
Get service 2f7904cb-1e92-4a68-ad62-f01893b21223_authz
Update service 2f7904cb-1e92-4a68-ad62-f01893b21223_authz; spec: /tmp/svcspec_ywzQZU
Get service 728e8810-2430-4ba5-86f9-45f08b3a0170
Update service 728e8810-2430-4ba5-86f9-45f08b3a0170; spec: /tmp/svcspec_88EEeT
Get service 0c4d9fcb-7566-47e3-9090-68c1cdc9becf
Update service 0c4d9fcb-7566-47e3-9090-68c1cdc9becf; spec: /tmp/svcspec_MN53_w
Get service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.vmware.vShieldManager
Don't update service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.vmware.vShieldManager
Get service 6eac5bdf-9474-460f-9736-e11b08aa7777
Update service 6eac5bdf-9474-460f-9736-e11b08aa7777; spec: /tmp/svcspec_4b7REc
Get service 2f7904cb-1e92-4a68-ad62-f01893b21223_kv
Update service 2f7904cb-1e92-4a68-ad62-f01893b21223_kv; spec: /tmp/svcspec_FhYW9r
Get service 000433fc-57b6-4d17-a20d-b3d5ee9c2332
Update service 000433fc-57b6-4d17-a20d-b3d5ee9c2332; spec: /tmp/svcspec_PRC3aK
Get service 2f7904cb-1e92-4a68-ad62-f01893b21223
Update service 2f7904cb-1e92-4a68-ad62-f01893b21223; spec: /tmp/svcspec_av4kDV
Get service 120e9890-15c3-4b8a-852d-1a3fa0f1d614
Update service 120e9890-15c3-4b8a-852d-1a3fa0f1d614; spec: /tmp/svcspec_Oh_UPT
Get service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.vmware.nsx.ui.h5
Don't update service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.vmware.nsx.ui.h5
Get service e39b60e1-d359-46ca-83da-3cff4f99bfa2
Update service e39b60e1-d359-46ca-83da-3cff4f99bfa2; spec: /tmp/svcspec_xFegrR
Get service 355c8913-87ba-466e-819a-de250781fce7
Update service 355c8913-87ba-466e-819a-de250781fce7; spec: /tmp/svcspec_2UIbm6
Get service 228f53f4-41bd-4235-a399-589f8fc13dd6
Update service 228f53f4-41bd-4235-a399-589f8fc13dd6; spec: /tmp/svcspec_mLxlzG
Get service 6f3eb5ec-c0b4-4567-9a4a-f7a1fced8b5a
Update service 6f3eb5ec-c0b4-4567-9a4a-f7a1fced8b5a; spec: /tmp/svcspec_ogwZnz
Get service 31cfd323-b80c-419e-9602-57971dc52f75
Update service 31cfd323-b80c-419e-9602-57971dc52f75; spec: /tmp/svcspec_U_Cxsu
Get service dbedd20d-71af-4cbd-83ba-0c09330c5482
Update service dbedd20d-71af-4cbd-83ba-0c09330c5482; spec: /tmp/svcspec_G00oCi
Get service 4df51084-d11d-4743-8469-2cb70494fe97
Update service 4df51084-d11d-4743-8469-2cb70494fe97; spec: /tmp/svcspec_5oRCnO
Get service ef6286ea-748b-46a0-986f-c1c4bd81ce4d
Update service ef6286ea-748b-46a0-986f-c1c4bd81ce4d; spec: /tmp/svcspec_yDAuik
Get service 969f91a2-77f5-422f-8b1e-12de2cac65d4
Update service 969f91a2-77f5-422f-8b1e-12de2cac65d4; spec: /tmp/svcspec_vs_Lns
Get service 0d44c1ae-547e-4e98-bb2b-5024001c7e38
Update service 0d44c1ae-547e-4e98-bb2b-5024001c7e38; spec: /tmp/svcspec_Dd2cNF
Get service 70886a6d-e3b9-42bd-83ba-45d846b01132
Update service 70886a6d-e3b9-42bd-83ba-45d846b01132; spec: /tmp/svcspec_CuhI5U
Get service eefeaa50-43bc-48c9-bd52-a229ec7e37c5
Update service eefeaa50-43bc-48c9-bd52-a229ec7e37c5; spec: /tmp/svcspec_MX2vDZ
Get service a8ce77be-62f9-4e38-a819-c3c7933f5cf3
Update service a8ce77be-62f9-4e38-a819-c3c7933f5cf3; spec: /tmp/svcspec_KosPtT
Get service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.zerto.plugin
Don't update service f56e5d8e-7e0d-4596-892a-5fe183259f3a_com.zerto.plugin
Get service b10d419c-1b39-4313-8d25-dd9caede4d94
Update service b10d419c-1b39-4313-8d25-dd9caede4d94; spec: /tmp/svcspec_NUwo8F
Get service 735a9c8b-13cc-406f-a087-566e37c7dc97
Update service 735a9c8b-13cc-406f-a087-566e37c7dc97; spec: /tmp/svcspec_qQ6k55
Updated 30 service(s)
Status : 60% Completed [Reset vpxd-extension Cert...]
2022-07-21T03:37:11.630Z Updating certificate for "com.vmware.vim.eam" extension
2022-07-21T03:37:11.839Z Updating certificate for "com.vmware.rbd" extension
Reset status : 100% Completed [Reset completed successfully]
再度、証明書の有効期限チェックを行い、無事期限が延長されたことを確認した。
証明書の有効期限チェック
root@vcenter-vcs65 [ /tmp ]# for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; sudo /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done
STORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
Not After : Jul 20 03:25:23 2024 GMT
STORE TRUSTED_ROOTS
Alias : c24fa5a7ea6b8cecc066931f518a5e3e5dfdeec9
Not After : Jul 2 18:37:08 2029 GMT
Alias : 43f13372a45541a86fc0cb32928ab8d7c3fcae3d
Not After : Jul 15 03:35:22 2032 GMT
STORE TRUSTED_ROOT_CRLS
Alias : 3b417b2c774a383d165934a475d1da514620a4b3
Alias : a2578e4b1e3710b810d4a4530ebfdf4a41ebf249
STORE machine
Alias : machine
Not After : Jul 20 03:27:09 2024 GMT
STORE vsphere-webclient
Alias : vsphere-webclient
Not After : Jul 20 03:27:10 2024 GMT
STORE vpxd
Alias : vpxd
Not After : Jul 20 03:27:10 2024 GMT
STORE vpxd-extension
Alias : vpxd-extension
Not After : Jul 20 03:27:11 2024 GMT
STORE SMS
Alias : sms_self_signed
Not After : Jul 8 18:42:29 2029 GMT
STORE BACKUP_STORE
Alias : bkp___MACHINE_CERT
Not After : Jul 8 06:37:08 2021 GMT
Alias : bkp_machine
Not After : Jul 7 18:28:04 2021 GMT
Alias : bkp_vsphere-webclient
Not After : Jul 7 18:28:04 2021 GMT
Alias : bkp_vpxd
Not After : Jul 7 18:28:05 2021 GMT
Alias : bkp_vpxd-extension
Not After : Jul 7 18:28:05 2021 GMT
サービスも無事再起動されて、vCenterにアクセスできるようになった。
サービスの再起動
root@vcenter-vcs65 [ /tmp ]# service-control --stop --all
root@vcenter-vcs65 [ /tmp ]# service-control --start --all
6. vCenterからNSXが認識されない問題の解決
NSX-Vの操作をしようとすると以下のようなエラーが発生する。これは証明書を再生成したためNSX ManagerがvCenterなどにアクセスできないためである。
NSX-ManagerからEditボタンを押して再登録を行う。
最終的に以下のようになり、vCenterからNSXのリソースにアクセス可能になる。
7. NSX-VのHost Preparationでの問題解決について
さらに、NSX-VのHost PreparationNSX Versionが以下のようにNot Readyになっていた。これは、新しい証明書に更新されてEAM agentがvCenterにアクセスできなくなってしまったためである。
以下のKBに従って修正する。
https://kb.vmware.com/s/article/2139071
root@vcenter-vcs65 [ ~ ]# mkdir /certificate
root@vcenter-vcs65 [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.crt
root@vcenter-vcs65 [ ~ ]# /usr/lib/vmware-vmafd/bin/vecs-cli entry getkey --store vpxd-extension --alias vpxd-extension --output /certificate/vpxd-extension.key
root@vcenter-vcs65 [ ~ ]# python /usr/lib/vmware-vpx/scripts/updateExtensionCertInVC.py -e com.vmware.vim.eam -c /certificate/vpxd-extension.crt -k /certificate/vpxd-extension.key -s vcenter-vcs65.vcs65.ibm.local -u Administrator@vsphere.local
Password to connect to VC server for user="Administrator@vsphere.local":
2022-07-21T08:20:53.155Z Updating certificate for "com.vmware.vim.eam" extension
2022-07-21T08:20:53.261Z Successfully updated certificate for "com.vmware.vim.eam" extension
Traceback (most recent call last):
File "/usr/lib/vmware-vpx/scripts/updateExtensionCertInVC.py", line 173, in <module>
update_extension_cert_in_VC()
File "/usr/lib/vmware-vpx/scripts/updateExtensionCertInVC.py", line 161, in update_extension_cert_in_VC
sessionMgr = si.content.sessionManager
File "/usr/lib/vmware/site-packages/pyVmomi/VmomiSupport.py", line 551, in __call__
return self.f(*args, **kwargs)
File "/usr/lib/vmware/site-packages/pyVmomi/VmomiSupport.py", line 371, in _InvokeAccessor
return self._stub.InvokeAccessor(self, info)
File "/usr/lib/vmware/site-packages/pyVmomi/StubAdapterAccessorImpl.py", line 23, in InvokeAccessor
return self.InvokeMethod(mo, info, (prop,))
File "/usr/lib/vmware/site-packages/pyVmomi/SoapAdapter.py", line 1409, in InvokeMethod
conn.request('POST', self.path, req, headers)
File "/usr/lib/python2.7/httplib.py", line 1042, in request
self._send_request(method, url, body, headers)
File "/usr/lib/python2.7/httplib.py", line 1082, in _send_request
self.endheaders(body)
File "/usr/lib/python2.7/httplib.py", line 1038, in endheaders
self._send_output(message_body)
File "/usr/lib/python2.7/httplib.py", line 882, in _send_output
self.send(msg)
File "/usr/lib/python2.7/httplib.py", line 844, in send
self.connect()
File "/usr/lib/python2.7/httplib.py", line 1263, in connect
server_hostname=server_hostname)
File "/usr/lib/python2.7/ssl.py", line 393, in wrap_socket
_context=self)
File "/usr/lib/python2.7/ssl.py", line 641, in __init__
self.do_handshake()
File "/usr/lib/python2.7/ssl.py", line 878, in do_handshake
match_hostname(self.getpeercert(), self.server_hostname)
File "/usr/lib/python2.7/ssl.py", line 316, in match_hostname
% (hostname, dnsnames[0]))
ssl.CertificateError: hostname 'sdkTunnel' doesn't match 'vcenter-vcs65.vcs65.ibm.local'
root@vcenter-vcs65 [ ~ ]# service-control --stop vmware-eam
Perform stop operation. vmon_profile=None, svc_names=['vmware-eam'], include_coreossvcs=False, include_leafossvcs=False
Successfully stopped service eam
root@vcenter-vcs65 [ ~ ]# service-control --start vmware-eam
Perform start operation. vmon_profile=None, svc_names=['vmware-eam'], include_coreossvcs=False, include_leafossvcs=False
2022-07-21T08:22:15.385Z Service eam state STOPPED
Successfully started service eam
上記スクリプト実行時にエラーが出ているが問題ないようだ。別の記事でも発生していた。再度Host preparationを確認すると、正しく表示されていることがわかる。
