Summary
Error
When running the command /opt/OV/bin/OpC/startInitialSync.sh in OML to synchronize the topology with OBM, it shows an error message:
Server : 'https://<OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr' is not available.
Please make sure that the certificates are in place and bbcutil -ping
Verfied there was no Firewall, network communication worked fine. Checking the bbcutil -ping <OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr works:
bbcutil -ping https://<OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr
https://<OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr:
status=eServiceOK coreID=87e76efc-d3ee-75b6-0f9a-97753096f094
bbcV=12.12.010 appN=com.hp.ov.ow.SvcDscSvr appV=unknown version
conn=0 time=97 ms
Cause
OBM 2020.05 TLSv1.1 and TLSv1.0 is disabled:
<OBM_HOME>\JRE\lib\security\java.security
jdk.tls.disabledAlgorithms=MD5, SSLv2Hello, TLSv1, TLSv1.1, RSA keySize < 1024, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSLv3, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 256, 3DES_EDE_CBC, anon, NULL
In Operations Agent 12.12, the default TLS version is 1.2:
ovconfget sec.core.ssl
[sec.core.ssl]
TLS 1 and 1.1 is diabled in OBM and connections from OML is done using any of the TLS versions. It should be restricted to use just TLSv1.2, that way OBM can accept the communication.
Fix
Need to configure OML to communicate using TLSv1.2 protocol:
- Set the variable in OML server:
ovconfchg -ns sec.core.ssl -set COMM_PROTOCOL TLSv1.2
- Restart the OM and all Agent processes
- Run again:
/opt/OV/bin/OpC/startInitialSync.sh in OML to synchronize the topology:
bash-4.1# /opt/OV/bin/OpC/startInitialSync.sh
Using data file : /tmp/tmp.yByiQ1nTnt/std_final.xml
Connecting to URI : https://<OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr
Data was transferred successfully to the target server.
Waiting a maximum of 60s for the discovery server to get ready for large data.
Discovery Server does not support large data URI, falling back.
Using data file : /tmp/tmp.yByiQ1nTnt/model_final.xml
Connecting to URI : https://<OBM_Server>:383/com.hp.ov.ow.SvcDscSvr/SvcDscSvr
Data was transferred successfully to the target server.
There is a known problem with Java GUI after enabling TLSv1.2, a hotfix need to be installed.
This is mentioned in below articles, hotfix should be requested to support.