Symptoms
Logging into Cyber Recovery 19.14 or earlier UI fails with the below message:
Internal Server Error
Logging into the Cyber Recovery 19.15 or later UI fails with the below message:
Service (users) is not responding
Cause
The identified cause is an expired Cyber Recovery certificate. Due to a coding issue, the certificate is expiring 2 years after it was generated, which is far shorter than the 10-year intended time period.When Cyber Recovery generates self-signed certificates, it uses a root certificate that is stored in the lockbox. That root certificate has a default expiration of 2 years. Even though the leaf certificates are properly generated in the /etc/certs/ssl directory with a 10-year expiration, the root certificate is also validated by the TLS logic, and is expired after 2 years.For Cyber Recovery 19.15 and later, the following RESTAPI error message is found in the /opt/dellemc/cr/var/log/edge.log:
[2024-07-01 09:53:32.213] [DEBUG] [edge] [restapi_client.go:197 callRestApi()] : Perform request.Post path=https://users:9094/irapi/v8/login
[2024-07-01 09:53:32.240] [ERROR] [edge] [restapi_client.go:200 callRestApi()] : Failed to perform request.Post:Post "https://users:9094/irapi/v8/login": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2024-07-01T09:53:32+04:00 is after 2024-06-30T12:02:54Z
[2024-07-01 09:53:32.241] [ERROR] [edge] [restapi_client.go:201 callRestApi()] : response is
[2024-07-01 09:53:32.241] [ERROR] [edge] [restapi_client.go:385 HandleRESTAPIResponse()] : RESTAPI error :Service (users) is not responding
Resolution
Workaround for Cyber Recovery 19.15 and later:
Take a VMware snapshot of the Cyber Recovery host.SSH to the Cyber Recovery Host, and run the following command (as the root user):
crsetup.sh --securereset
This resets the Cyber Recovery root certificates and encryption keys. It also stops the Cyber Recovery services, regenerate the certificates, store them in the lockbox, and then starts the Cyber Recovery services.
Log in to the Cyber Recovery UI, should once again be possible.
Workaround for Cyber Recovery 19.14 and earlier:The same steps above should be followed. However, if logging into the UI is still not possible, it is likely that the Docker containers must be re-created within Cyber Recovery.In this case, contact Dell Technical Support and log a Service Request referencing this article and the symptoms being faced. Cyber Recovery Engineering must examine the environment to ensure that the environment is encountering this known issue and to perform the recreation of the Docker containers.This is fixed in Cyber Recovery 19.18.
