Can't install certificate, receiving null error message about netapp.ontap HOT 7 CLOSED

I have since updated my module to the latest collection(netapp.ontap:21.17.3)

I now get an error saying:

  "msg": "na_ontap_security_certificates only supports REST, and requires ONTAP 9.6 or later. - HTTPSConnectionPool(host='test01', port=443): Max retries exceeded with url: /api/cluster?fields=version (Caused by SSLError(SSLEOFError(8, u'EOF occurred in violation of protocol (_ssl.c:618)'),))"

from netapp.ontap.

The initial issue was fixed in 21.16.0. The error message was wrongly generated when REST was not available. It was not an issue with na_ontap_security_certificates but a utility function it depends on.

So most likely, you experienced the same SSL issue.

This first part of the message is easy to interpret. Since we cannot reach your system, we cannot confirm it supports REST.

The second part is more difficult:
SSLError(SSLEOFError(8, u'EOF occurred in violation of protocol (_ssl.c:618)'),))

This is not something that comes from our module, and I don’t think it comes from ONTAP, so I’d suspect a networking issue. The first thing that comes to mind is a proxy issue. Are you using a proxy by any chance?

from netapp.ontap.

A bit of googling also suggests to check the version of OpenSSL. Could you try this with python 2.7:

from urllib2 import urlopen
urlopen('https://www.howsmyssl.com/a/check').read()

from https://stackoverflow.com/questions/33410577/python-requests-exceptions-sslerror-eof-occurred-in-violation-of-protocol

from netapp.ontap.

A bit of googling also suggests to check the version of OpenSSL. Could you try this with python 2.7:

from urllib2 import urlopen
urlopen('https://www.howsmyssl.com/a/check').read()

from https://stackoverflow.com/questions/33410577/python-requests-exceptions-sslerror-eof-occurred-in-violation-of-protocol

heres what i get:

$ python test5.py
Traceback (most recent call last):
  File "test5.py", line 2, in <module>
    urlopen('https://www.howsmyssl.com/a/check').read()
  File "/usr/lib64/python2.7/urllib2.py", line 154, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/lib64/python2.7/urllib2.py", line 437, in open
    response = meth(req, response)
  File "/usr/lib64/python2.7/urllib2.py", line 550, in http_response
    'http', request, response, code, msg, hdrs)
  File "/usr/lib64/python2.7/urllib2.py", line 475, in error
    return self._call_chain(*args)
  File "/usr/lib64/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/lib64/python2.7/urllib2.py", line 558, in http_error_default
    raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
urllib2.HTTPError: HTTP Error 403: Forbidden

from netapp.ontap.

The initial issue was fixed in 21.16.0. The error message was wrongly generated when REST was not available. It was not an issue with na_ontap_security_certificates but a utility function it depends on.

So most likely, you experienced the same SSL issue.

This first part of the message is easy to interpret. Since we cannot reach your system, we cannot confirm it supports REST.

The second part is more difficult: SSLError(SSLEOFError(8, u'EOF occurred in violation of protocol (_ssl.c:618)'),))

This is not something that comes from our module, and I don’t think it comes from ONTAP, so I’d suspect a networking issue. The first thing that comes to mind is a proxy issue. Are you using a proxy by any chance?

Hello, I actually think I have an idea of whats happening. We’re updating an expiring signed certificate, which requires the deletion of an existing certificate, which stops the ssl service. If the service stops every time a certificate is deleted, how am I supposed to install the new one. The SSL service is down after deleting.

from netapp.ontap.

So the new issue is that you cannot use certificate authentication after deleting the certificate. But how do you renew a certificate?

A few options:

1. You could install the new certificate with a new name. We support both a name and a common_name. Since this a different certificate, it seems a new name would help. name is not supported by ONTAP 9.6 or 9.7, but was added in 9.8. once the new certificate is installed, the old one can be safely deleted.
2. if you want to delete the certificate first, you can install the new one using username/password authentication. Though it defeats the purpose of using SSL authentication.

from netapp.ontap.

I'm closing this issue, as the original problem (NULL error message) was addressed in 21.16.0.
Usage issues can be tracked in Slack, as we already have a parallel conversation in #configurationmgmt.

from netapp.ontap.