PKIX path building failed when trying to add a host to the cluster with HTTPS linstor

[0sorkon]

• Bug Report

COMPONENT NAME

agent

CLOUDSTACK VERSION

controller - 4.18.1.0-shapeblue1
target host agent - 4.18.2.0-shapeblue0

CONFIGURATION

advanced networking
linstror as primary storage (https://storage.primary.company.net:3371)

OS / ENVIRONMENT

ubuntu 22.04

SUMMARY

When trying to add a host to the cluster, the host is added in an alert state. In the management server logs:
2024-04-23 13:47:41,730 WARN [c.c.a.m.AgentManagerImpl] (AgentConnectTaskPool-463:ctx-9e5be0cf) (logid:7611540c) Monitor StoragePoolMonitor says there is an error in the connect process for 64 due to Unable to connect host 64 to storage pool id 1 due to com.cloud.utils.exception.CloudRuntimeException: Unable establish connection from storage head to storage pool 1 due to javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The other few hosts of version 4.18.1.0 were added normally.

Certificates were added to the java keystore before the addition

keytool -import -trustcacerts -keystore /etc/ssl/certs/java/cacerts -storepass changeit -noprompt -alias linstor_controller -file /tmp/linstor.crt

[0sorkon]

UPDATE: downgrade to

cloudstack-agent=4.18.1.0-shapeblue0
cloudstack-common=4.18.1.0-shapeblue0

resolve this issue
I think 4.18.1.0-shapeblue1 would also work, but I'm not sure about upgrading to 4.18.2.0 because as I wrote in the beginning, I couldn't successfully connect the host.

[rohityadavcloud]

You must have both agent and management server in the same CloudStack version and build @0sorkon.

pinging @rp- to look at Linstor related issues and cert issues.

[rp-]

There is currently no support for an encrypted client connection with the CloudStack plugin.

[DaanHoogland]

@rp- , is this planned/unplanned? (i.e. how do we deal with this ticket)

[rp-]

this is the first request for this, I didn't have it on my TODO list.
I can add it, but certainly low priority.

[DaanHoogland]

this is the first request for this, I didn't have it on my TODO list. I can add it, but certainly low priority.

I'm not trying to tell you what to do @rp- , just trying to triage the ticket correctly