Symptoms

Prerequisites: PowerStoreOS 2.1The PowerStoreOS 2.1.X.X stand-alone Health Check thin package is installedThe appliance uses a custom https certificate The System Health Check in PowerStore Manager user interface (UI) or CLI fails for REST Configuration Service and Internal Management Network: [SVC:service@ServiceTag-B user]$ svc_health_check run Name Location Status Description REST Configuration Service node_b FAILED Internal error - please contact support ... Internal Management Network node_b FAILED Internal error - please contact support ... SUMMARY Status: FAILED Passed: 22 Failed: 2 Total: 24 Also, you might be unable to download Data Collects and Performance Metrics from the PowerStore Manager interface with "Failed to create SSL connection".

Cause

The Health Check verifies that the Management HTTP Certificate includes the Cluster IP of the Inter-Cluster Management (ICM) Network. This IP must be included for internal services to be able to properly communicate.

Resolution

Fix This issue is resolved in PowerStoreOS version 3.2.0.1 Workaround Use the PowerStoreCLI (pstcli) to verify the Subject Alternate Name (SAN) of the certificate: pstcli -u admin -d x509_certificate show # | id | type | service | is_current | is_valid ----+--------------------------------------+----------------------+------------------+------------+---------- 1 | 83057479-acbb-4b9e-9c7f-33443445477e | Server | Management_HTTP | yes | yes 2 | f24d419c-3892-4dac-b21c-bab6887213da | CA_Client_Validation | VASA_HTTP | yes | yes 3 | 5559d43a-43d4-4f15-868e-205d35f3e1a7 | CA_Client_Validation | Replication_HTTP | yes | yes pstcli -u admin -d x509_certificate -id show Remote certificate: id = xxxxxx type = Server type_l10n = Server service = Management_HTTP service_l10n = Management_HTTP is_current = yes is_valid = yes depth = 1 subject_alternative_names = dns.name.corp, , The Subject Alternative Names (SAN) section of the certificate with a depth of 1 is of relevance here - depth 2, 3,… are for the intermediate and root Certificate Authority (CA).There are two causes for this check to fail: The SAN does not include the ICM Cluster IP.The SAN contains the ICM Cluster IP. The ICM Cluster IP can be found in the Settings > Networking > Network IPs > ICM, with Purposes: ICM Cluster If the ICM Cluster IP is missing, the Certificate must be properly re-created. See KB 000193886 for instructions to re-create the certificate.If the SAN contains the required ICM Cluster IP and the DNS name / management IP used to access the PowerStore, the System Health check Version 2.1.X.X can be ignored. PowerStore uses a hard coded entry on the System Health Check for the certificate that is incorrect if the default self-signed certificate has been replaced.Unlike the Pre Upgrade Health Check (PUHC), a system health check does not block the upgrade. Any other errors or alerts should still be addressed before proceeding with the upgrade.

Support Cases