SU492: StorageGRID 11.2 and prior versions with custom server SSL 1024-bit certificates for S3 endpoints must convert the certificates when upgrading to 11.4

Summary

StorageGRID 11.2 and prior versions, using custom server SSL 1024-bit certificates or lower for S3 endpoints must convert to a higher key length prior to upgrading to StorageGRID 11.4. This is to avoid service unavailability due to a shorter key length below 2048 bits.

Solution

Pre-upgrade to 11.4:

Check existing certificates installed into StorageGRID cluster and correct if needed:

1. Confirm Certificates are using a 2048 certificate string:
   1. For Management Interface Server Certificate:
      1. Login to Storage Node or a Linux Client
      2. Run: openssl s_client <AdminNode_IP>:443
   2. For Object Storage API Service Endpoints Server Certificate:
      1. Login to Storage Node or a Linux Client
      2. Run: openssl s_client <StorageNode_IP>:18082
   3. Load Balancer endpoint certificate:
      1. In the StorageGRID Management Interface, navigate to Configuration > Load Balancer Endpoints.
      2. Identify HTTPS endpoints and note the TCP Port for each endpoint
      3. Run: openssl s_client <AdminNode_IP>:<TCP Port>
      4. Repeat above step for each endpoint
2. If all the above certificates Certificate (if in-use) are showing 2048 string, then no action is necessary.
   Server public key is 2048 bit
3. If any of the above certificates (if in-use) show(s) less than 2048 bit key, then please follow Certificate Installation for installing a supported certificate

Post upgrade to 11.4:

Issue #1: Loss of access to StorageGRID management interface

Temporarily replace the custom certificate with a StorageGRID self-signed certificate to restore client access:

1. Generate a self-signed certificate
   1. SSH to the primary admin node using admin user
   2. Switch to root user by running: su -
   3. Generate a self-signed certificate by running: make-certificate --type management --domains *.storagegrid.example.com
      1. Replace *.storagegrid.example.com with appropriate Common Name for your environment
2. Start services on primary admin node by running: service servermanager restart
3. Validate services are all in Running state by running: storagegrid-status
4. Attempt to access the StorageGRID management interface
5. After access is restored and before approving other nodes, validate the Object Storage API Service Endpoints Server Certificate AND Load Balancer endpoint certificate. See pre-upgrade to 11.4 steps.

Issue #2: S3 or SWIFT (read/write) failures to StorageGRID after upgrade to 11.4

All storage services may appear in a running state, but new client requests are failing. Below error message may be observed in /var/local/log/bycast.log on the storage node(s).

Feb 12 18:24:59 ksabobssga01 ADE: |12087627 0000000000 ---- ---- 2022-02-12T18:24:59.836323| NOTICE 1401 HFCS: Connection 1644690299835915/172.24.160.200:33625 (---------): Closing: handshake: ca key too small (20,316,397)

Temporarily replace the custom certificate with a StorageGRID self-signed certificate to restore client access:

1. Generate a self-signed certificate
   1. SSH to the primary admin node using admin user
   2. Switch to root user by running: su -
   3. Generate a self-signed certificate by running: make-certificate --type storage --domains *.storagegrid.example.com
      1. Replace *.storagegrid.example.com with appropriate Common Name for your environment.

To install new custom certificates, please visit the StorageGRID Configuring Server Certificates page.

Issue #3: Storage node service(s) are not starting and LDR in error state

Please engage NetApp Technical Support for further assistance.

Additional Information

https://docs.netapp.com/sgws-112/top...A45A12B026.html