IT41755: VM BACKUPS FAIL WITH ANS2374E (RC7203) AFTER INSTALLING CA SIGNED CERTIFICATES ON THE VCENTER

APAR status

• Closed as program error.

Error description

• After installing CA signed certificates on the vCenter server,
  the backup of a Virtual Machine (VM) fails with following error:
  
  ANS2374E The VMware vCloud Suite plug-in library failed to
  connect to the vCenter Management Server.
  ANS2374E (RC7203) The VMware vCloud Suite plugin library failed
  to connect to the vCenter Management Server.
  
  vcsplugin.log shows the following additional information when
  "logger.ve.level = ALL" is set in C:\Program Files\Tivoli\TSM\b
  aclient\plugins\vcloudsuite\sdk\log4j.properties
  
  DEBUG [VCloudSuiteConnection] connect(): Opening platform
  service controller, management server and service manager
  connections.
  DEBUG [VCloudSuiteConnection] _connect(): Initiating platform
  service controller, management server and service manager
  connections for user: backupuser@vsphere.domain
  DEBUG [VCloudSuiteConnection] _connect(): Platform Services
  Controller = https://vcenter.domain.name/lookupservice/sdk
  DEBUG [VConnectionUtil] getvCenterMgmtServerNodeId(): Retrieving
  the vCenter Management Server Node Id:
  vcMgmtServerHost=vcenter.domain.name,
  attemptDefaultHostOnFailure=false
  DEBUG [VConnectionUtil] getvCenterMgmtServerNodeId(): A vCenter
  Management Server Node Id was found.
  DEBUG [VCloudSuiteConnection] _connect(): vCenter Management
  Server = vcenter.domain.name
  ERROR [ReturnValue] [rc = 7203] connect(): connect(): Failed to
  connect to the vCenter Management Server [vcenter.domain.name],
  https://vcenter.domain.name:443/api invocation failed with
  "javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX
  path building failed:
  com.ibm.security.cert.IBMCertPathBuilderException: unable to
  find valid certification path to requested target"
  
  IBM Spectrum Protect Versions Affected: IBM Spectrum Protect for
  Virtual Environments - Data Protection for VMware 8.1 on Windows
  and Linux
  
  Additional Keywords: TSM, Tivoli, Storage, Manager, tagging,
  certificate, authority
  

Local fix

• Disable the usage of tag based backups using the following
  steps:
  1. Set following option in the datamover: vmtagdatamover no
  2. Run VM backups specifying VM names or a non-tag based
  schedule instead of a tagschedule
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Data Protection for VMware versions 8.1.7, 8.1.8, 8.1.9,     *
  * 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, and 8.1.15 running   *
  * on Linux x86 and Windows x64 platforms                       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is       *
  * projected to be fixed in level 8.1.15.2 and 8.1.17. Note     *
  * that until the fixing level is actually available, this      *
  * information is subject to change at the discretion of IBM.   *
  ****************************************************************
  

Problem conclusion

• The vCloud Suite plugin is successfully connected to the vCenter
  Management Server when CA certificates were installed on
  vCenter. No errors are thrown.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM FOR VE DP V

• Fixed component ID

  5725TVEVM

Applicable component levels