On VCS 7.4.x/Linux environments that use CP servers as part of their fencing configuration, vxfen may fail to start properly if the InfoScale 7.4.2u4 Linux patch is installed on either the VCS cluster or on the CP server.
Article ID: 100053164
Updated On:
Description
Error Message
[root@server101 ~]# systemctl restart vxfen.service
[root@server101 ~]# systemctl -l status vxfen.service
● vxfen.service - VERITAS I/O Fencing (VxFEN)
Loaded: loaded (/opt/VRTSvcs/vxfen/bin/vxfen; disabled; vendor preset: disabled)
Active: active (running) since Thu 2022-05-26 05:05:13 PDT; 12s ago
Process: 31562 ExecStop=/opt/VRTSvcs/vxfen/bin/vxfen stop 2>&1 (code=exited, status=0/SUCCESS)
Process: 32614 ExecStart=/opt/VRTSvcs/vxfen/bin/vxfen start 2>&1 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/vxfen.service
├─1216 /bin/sh /sbin/vxfen-startup
└─1574 sleep 10
May 26 05:05:08 server101 systemd[1]: Starting VERITAS I/O Fencing (VxFEN)...
May 26 05:05:08 server101 vxfen[32614]: Starting vxfen..
May 26 05:05:08 server101 vxfen[32614]: Loaded 3.10.0-1160.el7.x86_64 on kernel 3.10.0-1160.59.1.el7.x86_64
May 26 05:05:08 server101 vxfen[32614]: WARNING: No modules found for 3.10.0-1160.59.1.el7.x86_64, using compatible modules for 3.10.0-1160.el7.x86_64.
May 26 05:05:13 server101 vxfen[32614]: CPS ERROR V-97-1400-937 None of the SSL certificates found in directory /var/VRTSvxfen/security/certs/ could be used to successfully connect to #.#.#.#
May 26 05:05:13 server101 vxfen[32614]: Starting vxfen.. Done
May 26 05:05:13 server101 vxfen[32614]: Please see the log file /var/VRTSvcs/log/vxfen/vxfen.log
May 26 05:05:13 server101 systemd[1]: Started VERITAS I/O Fencing (VxFEN).
[root@server101 ~]# cpsadm -s
CPS ERROR V-97-1400-937 None of the SSL certificates found in directory /var/VRTSvxfen/security/certs/ could be used to successfully connect to #.#.#.#
Cause
As part of the InfoScale 7.4.2u4 patch TLS1_2 is set as default. The /etc/vxcps_ssl.properties file includes the following line:
openSSL.server.requireTLSv1_2 = true
As a result of this TLS difference the communication between the CP server and its clients will be broken if either is upgraded.
Resolution
If only the CP server has been upgraded, then offlining the CPSSG servicegroup, modifying the /etc/vxcps_ssl.properties file (ie commenting out the above line ) and then re-onlining the CPSSG servicegroup should resolve the issue.
If the VCS cluster itself has been patched, then stopping vxfen, modifying the /etc/vxcps_ssl.properties file and then restarting vxfen should resolve the issue.
This issue will not occur with the forthcoming InfoScale 7.4.2u4 patches for Solaris and Aix.
Issue/Introduction
