Private/Checks/VCenter/Test-VcfVcenterMachineSslMismatch.ps1
|
# Copyright (c) 2026 Broadcom. All Rights Reserved. # Broadcom Confidential. The term "Broadcom" refers to Broadcom Inc. # and/or its subsidiaries. # # ============================================================================= # # SOFTWARE LICENSE AGREEMENT # # Copyright (c) CA, Inc. All rights reserved. # # You are hereby granted a non-exclusive, worldwide, royalty-free license # under CA, Inc.'s copyrights to use, copy, modify, and distribute this # software in source code or binary form for use in connection with CA, Inc. # products. # # This copyright notice shall be included in all copies or substantial # portions of the software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS # IN THE SOFTWARE. # # ============================================================================= function Test-VcfVcenterMachineSslMismatch { <# .SYNOPSIS Checks that every :443 service registered with vCenter's Lookup Service presents the SSL certificate registered in the Lookup Service. .DESCRIPTION Queries vCenter Lookup Service registrations on each vCenter appliance attached to SDDC Manager via Invoke-VcfApplianceCommand using `/usr/lib/vmware-lookupsvc/tools/lstool.py`. Retrieves registered service URLs listening on port 443 along with their registered `SSL trust:` fingerprint values. Connects to each unique endpoint via `openssl s_client` in a batched execution script to compare live SSL certificate fingerprints against registered trust values. Evaluation logic: - Pass: All registered :443 endpoints match their registered SSL trust fingerprint. - Warning: One or more endpoints present a fingerprint mismatch, or a TLS connection cannot be established to a registered endpoint. - Skipped: VMware Tools is not running on the target vCenter appliance VM. - Error: `lstool.py` or `openssl` batch execution encounters an unexpected failure. Dynamic environment resolution: - Resolves `VMWARE_JAVA_HOME` dynamically at runtime using `command -v java`. Execution scope: - Targets vCenter appliance VMs through the management vCenter (Get-VcfCheckManagementVCenterFqdn) and delegates per-domain outcome packaging to Invoke-VcfCheckPerVCenterCheck. .PARAMETER Context The VcfCheck.Context object. Must already be connected to SDDC Manager. .PARAMETER DisplayName Optional friendly display name for the check result. .OUTPUTS [PSObject[]] Per-vCenter check results generated by Invoke-VcfCheckPerVCenterCheck. #> [CmdletBinding()] [OutputType([PSObject])] Param ( [Parameter(Mandatory = $true)] [PSObject]$Context, [Parameter(Mandatory = $false)] [String]$DisplayName = '' ) return Invoke-VcfCheckPerVCenterCheck -Context $Context -CheckId 'vcenter_machine_ssl_mismatch' -Area vCenter -DisplayName $DisplayName -Body { param($Context, $VCenterFqdn) $managementVCenterFqdn = Get-VcfCheckManagementVCenterFqdn -Context $Context Connect-VcfCheckVCenter -Context $Context -Fqdn $managementVCenterFqdn $rootCredential = Get-VcfCheckComponentCredential -Context $Context -ResourceType VCENTER -AccountType USER -Fqdn $VCenterFqdn -Username 'root' $vmName = ($VCenterFqdn -split '\.')[0] $lstoolResult = Invoke-VcfApplianceCommand -VmName $vmName -Server $managementVCenterFqdn -Credential $rootCredential ` -ScriptText 'JAVA_BIN=$(command -v java 2>/dev/null); if [ -n "$JAVA_BIN" ]; then export VMWARE_JAVA_HOME=$(dirname $(dirname $(readlink -f "$JAVA_BIN"))); else export VMWARE_JAVA_HOME=/usr/java/default; fi; export VMWARE_CFG_DIR=/etc/vmware; /usr/lib/vmware-lookupsvc/tools/lstool.py list --url https://localhost/lookupservice/sdk --no-check-cert' if (-not $lstoolResult.Success) { if ($lstoolResult.ErrorCategory -eq 'ToolsNotRunning') { $detail = "This check cannot run without VMware Tools running on the target appliance - skipped for now. $($lstoolResult.ErrorMessage)" return [PSCustomObject]@{ Status = 'Skipped'; Detail = $detail; SkipReasonTag = 'VMware Tools not running'; Rows = @() } } return [PSCustomObject]@{ Status = 'Error'; Detail = $lstoolResult.ErrorMessage; Rows = @() } } $lstoolLines = @($lstoolResult.ScriptOutput -split "`n") $expectedTrustByUrl = [Ordered]@{} $pendingUrl = $null foreach ($line in $lstoolLines) { if ($line -match '^URL: ') { $pendingUrl = $null if ($line -notmatch ':443') { continue } $rawUrl = $line.Substring(5) -replace '^https?://(www\.)?', '' $url = (($rawUrl -split '/')[0]).ToLowerInvariant() if (-not $expectedTrustByUrl.Contains($url)) { $pendingUrl = $url } continue } if ($pendingUrl -and $line -match '^SSL trust:') { $expectedTrustByUrl[$pendingUrl] = $line.Substring('SSL trust:'.Length).Trim() $pendingUrl = $null } } if ($expectedTrustByUrl.Count -eq 0) { $detail = 'No :443 service registrations with an SSL trust value were found via lstool.' return [PSCustomObject]@{ Status = 'Pass'; Detail = $detail; Rows = @() } } $urlListForShell = $expectedTrustByUrl.Keys -join "`n" $batchScript = @" while IFS= read -r u; do if [ -z "`$u" ]; then continue; fi echo "===URL:`$u===" echo | openssl s_client -connect "`$u" -servername "`$u" -connect_timeout 10 2>&1 echo "===END===" done <<'VCFCHECK_URLS' $urlListForShell VCFCHECK_URLS exit 0 "@ $checkStartedAt = Get-Date $opensslBatchResult = $null $batchError = $null try { $opensslBatchResult = Invoke-VcfApplianceCommand -VmName $vmName -Server $managementVCenterFqdn -Credential $rootCredential -ScriptText $batchScript } catch { $batchError = $_.Exception.Message } finally { Write-LogMessage -Type DEBUG -Message "[$VCenterFqdn] Batched SSL trust check for $($expectedTrustByUrl.Count) URL(s) took $(Format-VcfCheckDuration -Milliseconds ((Get-Date) - $checkStartedAt).TotalMilliseconds)." } if ($batchError -or -not $opensslBatchResult.Success) { $errorMessage = $opensslBatchResult.ErrorMessage if ($batchError) { $errorMessage = $batchError } return [PSCustomObject]@{ Status = 'Error'; Detail = "Unable to verify live SSL certificates: $errorMessage"; Rows = @() } } $outputByUrl = @{} $blocks = @($opensslBatchResult.ScriptOutput -split '===URL:') foreach ($block in $blocks) { if ($block -notmatch '(?s)^(?<url>\S+)===\r?\n(?<body>.*?)===END===') { continue } $outputByUrl[$Matches.url.ToLowerInvariant()] = $Matches.body } $overallStatus = 'Pass' $rowResults = foreach ($url in $expectedTrustByUrl.Keys) { $expectedTrust = $expectedTrustByUrl[$url] $status = 'Unknown' $message = '' $liveOutput = $outputByUrl[$url] if (-not $liveOutput -or $liveOutput -notmatch 'CONNECTED\(') { $overallStatus = 'Warning' $status = 'Error' $message = 'could not verify - unable to establish a TLS connection to this endpoint. This is not a trust mismatch; verify network connectivity/firewall rules between the management vCenter appliance and this endpoint, and that the service is running, before re-running this check' [PSCustomObject]@{ Line = "$url`: $message" Row = [PSCustomObject]@{ URL = $url; Status = $status; Message = $message } } continue } if ($liveOutput.Contains($expectedTrust)) { $status = 'Pass' $message = 'SSL trust matches' $line = "$url`: SSL trust matches (GREEN)" } else { $overallStatus = 'Warning' $status = 'Warning' $message = 'SSL trust MISMATCH' $line = "$url`: SSL trust MISMATCH (RED) - expected `"$expectedTrust`" not found in the live certificate chain. Remediate by running lsdoctor.py with the -t (trustfix) flag - see https://knowledge.broadcom.com/external/article/412746/ssl-trust-mismatch-reported-by-vdt-on-vc.html" } [PSCustomObject]@{ Line = $line Row = [PSCustomObject]@{ URL = $url Status = $status Message = $message } } } $resultLines = @($rowResults | ForEach-Object { $_.Line }) $rows = @($rowResults | Where-Object { $null -ne $_.Row } | ForEach-Object { $_.Row }) return [PSCustomObject]@{ Status = $overallStatus; Detail = ($resultLines -join "`n"); Rows = $rows } } } |