VncTLSSecurity Error when VM Console Proxy connects to Hypervisor

[KuasarCloud]

Hey team,

Is there a procedure to renew Hyp VNC TLS Cert? My Proxy Console VM gets this error when accessing the VNC Server

Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,683  INFO NoVncClient:65 - Connecting to VNC server xxxxx:5950 ...
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,742  INFO VncTLSSecurity:65 - Processing VNC TLS security
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: 00:24:25,743  INFO Link:415 - Conf file found: /usr/local/cloud/systemvm/conf/agent.properties
Jan 26 00:24:25 v-1049-VM _run.sh[2710]: Exception in thread "Thread-480" com.cloud.utils.exception.CloudRuntimeException: javax.net.ssl.SSLHandshakeException: NotAfter: Tue Aug 06 19:04:44 UTC 2024
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.vnc.security.VncTLSSecurity.process(VncTLSSecurity.java:96)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.vnc.NoVncClient.processHandshakeSecurityType(NoVncClient.java:518)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakeSecurityResult(ConsoleProxyNoVncClient.java:209)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.ConsoleProxyNoVncClient.handshakePhase(ConsoleProxyNoVncClient.java:203)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateVNCServerThroughNioSocket(ConsoleProxyNoVncClient.java:231)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.ConsoleProxyNoVncClient.authenticateToVNCServer(ConsoleProxyNoVncClient.java:188)
Jan 26 00:24:25 v-1049-VM _run.sh[2710]:         at com.cloud.consoleproxy.ConsoleProxyNoVncClient$1.run(ConsoleProxyNoVncClient.java:107)

Thanks

[KuasarCloud]

Something curious about the error is that older vms are having the problem not the new ones

[weizhouapache]

This looks same as #9718

[KuasarCloud]

Thanks @weizhouapache for your reply, after reading the article I have couple doubts

1. The error says -> NotAfter: Tue Aug 06 19:04:44 UTC 2024 but the cloud.crt in the Hyp is not expired -> notAfter=Jul 22 19:35:30 2025 GMT because ca.framework.cert.automatic.renewal is enabled
2. The weird thing here is that for old vms the NoVNC is not working but for recently created ones is working, do I have to restart the libvirtd daemon? If I do it will reboot my vms? I guess no but want to be sure as this is a prod env.

[weizhouapache]

Thanks @weizhouapache for your reply, after reading the article I have couple doubts

1. The error says -> NotAfter: Tue Aug 06 19:04:44 UTC 2024 but the cloud.crt in the Hyp is not expired -> notAfter=Jul 22 19:35:30 2025 GMT because ca.framework.cert.automatic.renewal is enabled
2. The weird thing here is that for old vms the NoVNC is not working but for recently created ones is working, do I have to restart the libvirtd daemon? If I do it will reboot my vms? I guess no but want to be sure as this is a prod env.

you can migrate the vms

[KuasarCloud]

Thanks @weizhouapache

For what purpose? restart libvirtd? or not use this Hyp?

[weizhouapache]

the new vm (qemu process) will use the new cert

[jhuijbrechts]

Maybe by default set this to a bigger time? As it seems to be a common issue, I had the same issue, as well as the person in the original issue.

[weizhouapache]

Maybe by default set this to a bigger time? As it seems to be a common issue, I had the same issue, as well as the person in the original issue.

yes, the default value 365 is too small.