template download failedfrom AWS s3 bucket

[anjanahkarthic]

we upgraded the ACS to new version and live patched the system VM. Then we attempted to launch a template in Apache CloudStack using a link stored in an AWS S3 bucket. While the template downloads successfully in a browser, it fails to download in CloudStack using the same link. The error displayed was: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target."

2024-07-31 13:04:15,686 WARN  [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) alertType=[28] dataCenterId=[1] podId=[null] clusterId=[null] message=[Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 WARN  [c.c.a.AlertManagerImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) No recipients set in global setting 'alert.email.addresses', skipping sending alert with subject [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] and content [Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target].
2024-07-31 13:04:15,694 ERROR [o.a.c.s.i.BaseImageStoreDriverImpl] (RemoteHostEndPoint-6:ctx-6f236fa3) (logid:1cb30631) Failed to register template: 95134df5-b4e9-40bc-af22-43f7053fc1a9 with error: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[kiranchavala]

@anjanahkarthic

are you download the template from the ssvm

example get a presinged s3 URL for the object

http://10.0.32.251:9000/kiran-bucket2/kvm.qcow2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20240802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240802T050929Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=39e16a5ffd7bea25a62f11c9f39ae6153d809fb82f936a9baa1ef54887a76909

Login to the ssvm and do a curl

example

curl -o test.qcow2 "http://10.0.32.251:9000/kiran-bucket2/kvm.qcow2?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=admin%2F20240802%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240802T050929Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=39e16a5ffd7bea25a62f11c9f39ae6153d809fb82f936a9baa1ef54887a76909"

[anjanahkarthic]

I used the public AWS S3 bucket link over HTTPS to download the template. After upgrading ACS to a newer version and live-patching the system VM, I encountered a certificate issue when attempting to download the template. The error displayed was: "PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target."

It appears that the SSL certificate keystore was not updated during the live patching of the secondary storage VM. By deleting the old VM and launching a new one with the latest system VM 4.19.1 template, the certificate keystore was updated, and I can now successfully download the template.

It would be beneficial to update the SSL certificate keystore during system VM live patching.