nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Workflows from OCUM Fail

amayacitta

Hey guys,

When I do something simple from OCUM like a snapmirror update I get errors, it looks like HTTPS is unable to connect.

If i connect to the windows box where WFA is installed I can connect to those systems fine. Also under settings, datasources they appear fine.

23:31:57.054 INFO [Transfer SnapMirror] ### Command 'Transfer SnapMirror' in 'PERL' ###
23:31:59.742 INFO [Transfer SnapMirror] Connecting to the cluster: DC3PNETAPP01/DestinationClusterIp
23:31:59.805 INFO [Transfer SnapMirror] Credentials successfully provided for 'DC3PNETAPP01.ad.xxxxxx.co.uk'
23:31:59.867 INFO [Transfer SnapMirror] Credentials successfully provided for 'DC3PNETAPP01.ad.xxxxxx.co.uk'
23:31:59.930 INFO [Transfer SnapMirror] Trying to connect to DC3PNETAPP01.ad.xxxxxx.co.uk using HTTPS on port 443 with timeout 60000
23:32:00.023 INFO [Transfer SnapMirror] Error while connecting HTTPSin NaServer::verify_server_certificate: server certificate verification failed: unable to get local issuer certificate
23:32:00.086 INFO [Transfer SnapMirror] Trying to connect to DC3PNETAPP01.ad.xxxxxx.co.uk using HTTP on port 80 with timeout 60000
23:32:01.195 INFO [Transfer SnapMirror] Error while connecting HTTPSin Zapi::invoke, cannot connect to socket
23:32:01.242 ERROR [Transfer SnapMirror] Command failed for Workflow 'Transfer SnapMirror relationship' with error :
Unable to connect to array

23:32:01.242 INFO [Transfer SnapMirror] ***** Workflow Execution Failed *****

If I run this test script, it works fine. I followed this forum post and configured the environmental variables. I can run the perl script from any directory, so they work fine.

I'm lost 😞 anyone got any ideas?

####

use NaServer;

#Set Array credentials below
$array="DC1PNETAPP01.ad.xxxxxxxx.co.uk";
$username = "xxxxxxxx";
$pass = "xxxxxxxx";

$server = NaServer->new($array, 1, 14);
$server->set_style('LOGIN');
$server->set_admin_user($username, $pass);
$server->set_transport_type('HTTPS');
$server->set_server_cert_verification(0);
$output = $server->invoke( "system-get-version" );
if (ref ($output) eq "NaElement" && $output->results_errno != 0) {
# failed to establish connection
print "Connection failed";

print $output->results_reason;
}
else {
# successfully connected
print "Connected successfully";
}

########

Find more posts tagged with

Active IQ Unified Manager

Accepted answers

moep

I had a similar issue. This is new in WFA 5.1RC1, they activated the certificate check for perl workflows.

The root ca certificate store for perl resides in <installdir>\jboss\standalone\configuration\keystore\ontap.pem

Either put the filer certs or the root ca cert in the pem file.

All comments

amayacitta

This bit makes me wonder about certificate trusts, how do I add them? they are trusted from the windows side, I've also added the roots into the Java certificate store. Do they need to go somewhere else as well? Maybe perl has a certificate root store too that doesnt use the windows one?

23:32:00.023 INFO [Transfer SnapMirror] Error while connecting HTTPSin NaServer::verify_server_certificate: server certificate verification failed: unable to get local issuer certificate

Perhaps this but I dont fully understand it..

http://docs.activestate.com/activeperl/5.26/perl/lib/LWP/Protocol/https.html

"If hostname verification is requested by LWP::UserAgent's ssl_opts, and neither SSL_ca_file nor SSL_ca_path is set, then SSL_ca_file is implied to be the one provided by Mozilla::CA. If the Mozilla::CA module isn't available SSL requests will fail. Either install this module, set up an alternative SSL_ca_file or disable hostname verification.

This module used to be bundled with the libwww-perl, but it was unbundled in v6.02 in order to be able to declare its dependencies properly for the CPAN tool-chain. Applications that need https support can just declare their dependency on LWP::Protocol::https and will no longer need to know what underlying modules to install."

mbeattie

Hi,

I tested the WFA certified PERL command "transfer snapmirror" on WFA 5.0.1 succuessfully in my lab. Is it possible that there is a certifcate issue on the destination vserver? Have you tried cloning the command and disabling hostname verification? EG

$ENV{'PERL_LWP_SSL_VERIFY_HOSTNAME'} = 0;
my $wfa_util = WFAUtil->new();

Do you get the same error when updating the snapmirror relationship on a different vserver? Have you checked the certification expiration? EG

cluster2::> certificate show -fields expiration -type server -vserver vserver1_dr
  (security certificate show)
vserver     common-name serial           ca          type   subtype cert-name                    expiration
----------- ----------- ---------------- ----------- ------ ------- ---------------------------- ------------------------
vserver1_dr vserver1_dr 15B61346913114F7 vserver1_dr server -       vserver1_dr_15B61346913114F7 Wed Jul 29 13:58:34 2020

/Matt

amayacitta

Hi Matt,

I'm running 5.1.3212, the certificate hasn't expired and works fine on the WFA host outside of perl, I assume there is a way to import trusted root certificates and intermediates into the perl environment. Do you know how to do this? I've imported them into windows and Java but this doesn't effect the perl runtime.

Happy to try disabling SSL verify once but I dont fancy doing that for all workflows, doing it once will at least help us understand if it is or isnt SSL that's the issue.

amayacitta

Seems this is how it's done, just trying to work out what is meant and if I can pernamently add a CA rather than doing it per workflow. If anyone has done this before let me know.

https://metacpan.org/pod/LWP::UserAgent#ssl_opts