Troubleshooting SSL Certificate Configuration with cvCertManager

Temp workspace does not exist

Symptoms

When running Guided Setup > Import CA Certificates and Configure Tomcat (Phase 2), the following error appears:

ERROR: Temp workspace does not exist: <workspace path>

Cause

This error occurs when:

• Phase 2 was started without completing Guided Setup > Generate Key Pair and CSR (Phase 1) first.
• An incorrect workspace path was specified in Phase 2.
• The workspace directory created during Phase 1 is no longer accessible.

Troubleshooting

1. Verify that Guided Setup > Generate Key Pair and CSR (Phase 1) was completed successfully.

2. Note the exact workspace path created during Phase 1.

3. Confirm the workspace directory exists and is accessible.

4. Verify the path entered in Phase 2 matches the Phase 1 workspace path exactly (including case and special characters).

5. Check directory permissions to ensure the cvCertManager process can access the workspace.

Resolution

1. Run Guided Setup > Generate Key Pair and CSR (Phase 1) again to create a new workspace.

2. Use the exact workspace path from Phase 1 when running Phase 2.

3. Proceed with Phase 2 using the verified workspace path.

CSR was not generated in the workspace

Symptoms

When running Phase 2, the following error appears:

ERROR: CSR is not generated within this temp workspace.
Kindly run option 1: Generate keys and CSR

Cause

The selected workspace does not contain a previously generated Certificate Signing Request (CSR). This occurs when:

• Phase 1 was not completed successfully.
• An incorrect workspace directory was specified.
• The workspace was cleared or the CSR file was deleted.

Troubleshooting

1. Run Guided Setup > Generate Key Pair and CSR (Phase 1) successfully.

2. Monitor the Phase 1 operation to confirm it completes without errors.

3. Verify the workspace directory contains CSR and keystore files created by Phase 1.

4. Ensure the workspace directory selected during Phase 2 is exactly the same directory used in Phase 1.

Resolution

1. Complete Guided Setup > Generate Key Pair and CSR (Phase 1) successfully.

2. Note the workspace path displayed during Phase 1.

3. Use the identical workspace path when running Phase 2.

4. Verify the workspace directory contains CSR and keystore files before proceeding.

CA certificates are missing or do not form a valid certificate chain

Symptoms

When running Phase 2, the following error appears:

ERROR: Import CA Certificates failed (exit code: 182)

The log file may contain messages similar to:

No root certificate was found in the **cacerts** folder. The certificates found in the **cacerts** folder do not form a complete trust chain.  

Cause

The certificates in the cacerts directory are incomplete or do not form a valid trust chain. Common causes include:

• Missing root certificate.
• Missing one or more intermediate certificates.
• Missing server certificate.
• Extra or unrelated certificate files in the cacerts directory.
• Certificates from different trust chains mixed together.

Troubleshooting

1. Contact your Certificate Authority and confirm the complete certificate chain for your CSR.

2. The complete chain must include:

   • One server certificate (issued for your hostname)
   • Zero or more intermediate certificates (if applicable, in correct order)
   • One root certificate (the CA's self-signed root)

3. Navigate to the workspace cacerts directory and review all certificate files.

4. Remove any extra, unrelated, or duplicate certificate files.

5. Use certificate tools (such as OpenSSL) to validate that each certificate is valid and part of the same trust chain.

6. Verify the server certificate matches the CSR generated in Phase 1.

Resolution

1. Ensure the cacerts directory contains only the certificates provided by your Certificate Authority:

   • One server certificate
   • All intermediate certificates (in correct order if multiple exist)
   • One root certificate

2. Delete any extra or unrelated certificate files from the cacerts directory.

3. Verify the certificates form a complete trust chain.

4. Rerun Phase 2.

Certificate does not match the generated keystore

Symptoms

When running Phase 2, the following error appears:

ERROR: Import CA Certificates failed (exit code: 174)

The log file contains:

Certificate import failed because the public keys being imported do not match the ones in the keystore.

Cause

The certificate was not issued for the CSR generated during Phase 1. This commonly occurs when:

• Wrong certificate files were copied into the workspace.

• A certificate generated from another server or different CSR was used.

• The Certificate Authority issued a certificate for a different CSR.

Troubleshooting

1. Verify the certificate was issued by your Certificate Authority for the CSR generated in Phase 1.

2. Check the certificate's Common Name (CN) or Subject Alternative Name (SAN) to confirm it matches your intended hostname.

3. Contact your Certificate Authority to confirm which CSR this certificate was issued for.

4. Extract the public key from the Phase 1 CSR and the imported certificate and compare them.

5. If you manage multiple CSRs or servers, verify you are using the correct certificate set.

Resolution

1. Confirm the certificate was issued from the CSR generated during Phase 1.

2. If the certificate does not match, request a new certificate from your Certificate Authority.

3. Replace the incorrect certificate files in the workspace cacerts directory with the correct ones.

4. Rerun Phase 2.

Invalid keystore password (Existing Certificates Setup)

Symptoms

When running Existing Certificates Setup, the following error appears:

ERROR: Validate Keystore failed (exit code: 181)

The log file contains:

Invalid password provided for keystore.
Keystore is not valid.  

Cause

The password entered does not match the selected keystore file, or an incorrect keystore file was selected.

Troubleshooting

1. Verify the keystore password used during Existing Certificates Setup.

2. Confirm there are no extra spaces or special characters in the password entry.

3. Verify the correct keystore file was selected (check the file path and name).

4. If managing multiple keystores, confirm you are using the intended keystore.

5. Test the keystore independently using vendor-specific tools (such as keytool for .jks files) to validate the keystore and password.

Resolution

1. Re-enter the keystore password and verify it is correct (check for typos and spaces).

2. Confirm the correct keystore file is selected.

3. Retry Existing Certificates Setup with the correct credentials.

4. If the error persists, the keystore may be corrupted; request assistance from your Certificate Authority or system administrator.

Unsupported or invalid keystore

Symptoms

Keystore validation fails during Existing Certificates Setup without displaying a specific error code.

Cause

The keystore file is not valid, not supported, or corrupted. Possible causes include:

• The selected file is not a valid keystore.
• The keystore file format is not supported (.pfx, .p12, or .jks are required).
• The keystore file is corrupted or damaged.
• The keystore does not contain a server certificate and private key.

Troubleshooting

1. Verify the selected file is a supported keystore format: .pfx, .p12, or .jks

2. Check the file extension matches the keystore type

3. Use keystore validation tools to inspect the file contents:

   • For .jks files: Use keytool to list keystore contents
   • For .pfx/.p12 files: Use your operating system's certificate utilities or OpenSSL

4. Confirm the keystore contains:

   • A server certificate for your hostname.
   • The associated private key.
   • All intermediate and root certificates in the chain.

5. If the keystore was exported from another system (Windows Certificate Store, CA portal, etc.), verify it was exported in the correct format with the correct settings.

Resolution

1. Verify the selected file is a valid .pfx, .p12, or .jks keystore.

2. Confirm the keystore contains the server certificate and its associated private key.

3. If the keystore was exported, re-export it from the source using the correct format.

4. If the keystore is corrupted, request a new export from your Certificate Authority or system administrator.

5. Retry Existing Certificates Setup with the corrected keystore file.

Tomcat service does not restart after configuration

Symptoms

Certificate configuration completes successfully, but the Commvault Tomcat service fails to restart.

Cause

The Tomcat service failed to restart due to certificate validation issues, file access problems, or system-level errors.

Troubleshooting

1. Review cvCertManager.log for specific restart errors and error messages.

2. Check <workspace>/logs/CvCertTool.log for detailed diagnostics.

3. Verify the configured certificate is valid and not expired.

4. Verify the keystore file is accessible and the configured password is correct.

5. Test the keystore independently using keystore validation tools.

6. Check system-level logs for Tomcat or service startup failures.

7. Verify the system has sufficient disk space and required services are available.

8. Attempt to manually restart the Commvault Tomcat service using system service management tools.

Resolution

1. Review log files for specific restart error messages and take corrective action.

2. Verify the certificate and keystore are valid and accessible.

3. Manually restart the Commvault Tomcat service.

4. Confirm the Tomcat service status is running.

5. Monitor Tomcat logs for any SSL/TLS errors.

6. If the service continues to fail, preserve the workspace directory (it contains diagnostic information) and contact Commvault support.

Log files and error codes

Use the following log files when troubleshooting cvCertManager issues:

Exit code reference