Return
-
Title
"certificate signed by unknown authority" when running "/opt/quest/bin/vastool -d5 starling check" -
Description
When running "/opt/quest/bin/vastool -d5 starling check" the following error output is seen.# /opt/quest/bin/vastool -d5 starling check2019-01-21 11:38:55 [debug] (3587) _init_ipc_function_table: Initialized cache access via IPC.2019-01-21 11:38:55 [debug] (3587) libvas_setup_krb5_plugins: Successfully registered QAS kuserok plugin2019-01-21 11:38:55 [debug] (3587) libvas_setup_krb5_plugins: Successfully registered QAS send_to pluginChecking connection to Starling server ..... DEBUG2019/01/21 11:38:55 Checking connection to starling https://2faclient-test.cloud.oneidentity.com2019/01/21 11:38:55 Error is Get https://2faclient-test.cloud.oneidentity.com/Heartbeat: Post https://sts-test.cloud.oneidentity.com/auth/realms/StarlingClients/protocol/openid-connect/token: x509: certificate signed by unknown authority2019/01/21 11:38:55 Error returned was Get https://2faclient-test.cloud.oneidentity.com/Heartbeat: Post https://sts-test.cloud.oneidentity.com/auth/realms/StarlingClients/protocol/openid-connect/token: x509: certificate signed by unknown authority2019-01-21 11:38:55 [debug] (3587) vas_process_wait_for: WEXITSTATUS returned 5Checking connectoin to Starling server ..... FAILED2019-01-21 11:38:55 [debug] (3587) vastool command: /opt/quest/bin/vastool -d5 starling check -
Cause
This is caused by a missing certificate on the operating system. -
Resolution
RESOLUTION:
An updated certificate can be retrieved from this URL which also includes instructions for downloading the certificate.https://curl.haxx.se/docs/caextract.htmlA symlink from where the certificate is placed should be set up, for example.ln -s /opt/csw/etc/ssl /etc/The error should be cleared when running "/opt/quest/bin/vastool starling check" again.For updating this on FreeBSD specifically it requires different steps.
1. Using pgk install the ca_root_nss$ pkg install ca_root_nss2. This requires Ports Collection to be installed if it is not already. More information from FreeBSD can be seen here;https://www.freebsd.org/ports/installing.htmlFirst move to the ca_root_nss directory.$ cd /usr/ports/security/ca_root_nss/Then run the following command.$ make install clean