René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Local template/ISO upload fails silently due to expired SSL certificate on SSVM","articleBody":"### problem\n\nLocal template/ISO uploads fail silently because the SSVM uses an expired SSL certificate (expired February 7, 2017 - over 9 years ago). Modern browsers reject HTTPS requests to the SSVM without showing a clear error to the user. The upload appears to fail with a generic error 432, but the actual cause is the browser blocking the request due to certificate validation failure.\nThe request never reaches the SSVM at all - the browser blocks it before sending.\n\nRelated Issues\n\n- Related to #12486 \n- Related to #12488 \n- Related to #12489 \n\n### versions\n\nCloudStack Version: 4.20.2.0\nHypervisor: XenServer\nBrowser: Chrome 144.0.7559.59 (64-bit) on Linux\n\n### The steps to reproduce the bug\n\n1. Use a fresh browser session (or clear browser data/cache) and open the dev tools \n2. Navigate to CloudStack UI → Images → Templates\n3. Click on \"Upload Template from local\" \n4. Fill in template details \n5. Submit the upload\n6. Observe: Upload fails with error 432, no clear indication of SSL issue\n7. Verify: Check SSVM logs - no entry for the upload (request never arrived)\n8. Workaround: Open https://\u003cSSVM_PUBLIC_IP\u003e/ in browser, accept certificate warning\n9. Retry upload: Now it works!\n\n**Expected Result**\n\n- SSVM should use a valid, non-expired SSL certificate\n- OR CloudStack should provide a clear error message when SSL/certificate issues prevent uploads\n- OR the UI should warn users to accept the SSVM certificate before attempting uploads\n\n**Actual Result**\n\n- SSVM uses a certificate that expired in February 2017\n- Browser silently blocks upload requests (no certificate warning shown for XHR requests)\n- User sees generic \"error 432\" with no indication of the actual cause\n- Management server logs misleading \"SSVM agent not in Up state\" error\n- SSVM logs show nothing - the request never arrived\n\n**Evidence**\n\n- SSVM SSL Certificate is Expired (since 2017)\n\n```\n[root@mgmt1 ~]# curl -v -k https://10.0.52.202/upload/test-uuid\n* Server certificate:\n*  subject: O=*.realhostip.com; OU=Domain Control Validated; CN=*.realhostip.com\n*  start date: Feb  3 03:30:40 2012 GMT\n*  expire date: Feb  7 05:11:23 2017 GMT   ← EXPIRED 9 YEARS AGO!\n*  issuer: C=US; ST=Arizona; L=Scottsdale; O=GoDaddy.com, Inc.; OU=http://certificates.godaddy.com/repository; CN=Go Daddy Secure Certification Authority; serialNumber=07969287\n*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.\n```\n\n- Without -k flag, curl fails:\n\n```\n[root@mgmt1 ~]# curl -v https://10.0.52.202/upload/test-uuid\n* TLSv1.2 (OUT), TLS alert, unknown CA (560):\n* SSL certificate problem: unable to get local issuer certificate\ncurl: (60) SSL certificate problem: unable to get local issuer certificate\n```\n\n- Browser Network Tab - Requests BLOCKED Before Reaching SSVM: Two requests to SSVM failed:\n\n1. \"Provisional headers are shown\" warning - indicates request was blocked before completing\n2. No corresponding entries in SSVM logs (request never arrived)\n\n```\nRequest URL: https://10.0.52.202/upload/73708458-b5a9-44ae-8adf-848b6a58221a\nStatus: (failed)\n```\n\n\u003cimg width=\"3127\" height=\"1826\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/6045d833-f1d8-4476-948c-f36bbc3ce06a\" /\u003e\n\u003cimg width=\"3127\" height=\"1826\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/6f6c1f9a-7c64-4432-92ae-b59c90c6727a\" /\u003e\n\u003cimg width=\"3127\" height=\"1826\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/ad4af315-1658-4cb6-b3b3-9a63db61a5ac\" /\u003e\n\n- SSVM Received NOTHING for Failed Upload\n\n```\nroot@s-3-VM:~# grep -i \"73708458-b5a9-44ae-8adf-848b6a58221a\" /var/log/cloud.log\nroot@s-3-VM:~#   ← No output - request never reached SSVM!\n```\n\n- Apache Access Logs Empty\n\n```\nroot@s-3-VM:~# tail -50 /var/log/apache2/ssl_access.log\nroot@s-3-VM:~#   ← No entries!\n```\n\n- Browser Console Shows Error 432\n\n\u003cimg width=\"3127\" height=\"1826\" alt=\"Image\" src=\"https://github.com/user-attachments/assets/094e4244-8b74-47d8-89c8-9d2a4a7cc76b\" /\u003e\n\n- After Manually Accepting Certificate - Upload WORKS!\nAfter visiting https://10.0.52.202/ directly in browser and accepting the security warning\n\n- SSVM Logs now show upload received:\n\n```\n2026-01-21T19:29:59,472 INFO  [storage.resource.HttpUploadServerHandler] HEADER: SIGNATURE=gnUikA8l3imw7vcPg+F3Vf7LjNg=\n2026-01-21T19:29:59,472 INFO  [storage.resource.HttpUploadServerHandler] HEADER: METADATA=rkiZ0wSSLCNtmXVyIjEMb0EtD7rqZ2wAHMoHynkVCSBp...\n2026-01-21T19:29:59,473 INFO  [storage.resource.HttpUploadServerHandler] HEADER: EXPIRES=2026-01-21T20:29:59.270Z\n2026-01-21T19:29:59,475 INFO  [storage.resource.HttpUploadServerHandler] URI: uuid=a0972001-4901-4f67-b03a-7e2e4709efd4\n2026-01-21T19:31:17,968 INFO  [storage.resource.HttpUploadServerHandler] BODY FileUpload: ... filename=\"linux-debian-12-x86_64-gen2-v1.qcow2\" ... Completed: true\n```\n\n### What to do about it?\n\n**Option 1:** Generate Valid Self-Signed Certificate \nUpdate the SystemVM template to generate a fresh self-signed certificate on first boot, valid for a reasonable period (e.g., 10 years).\n\n**Option 2:** Use HTTP for Local Uploads\nSince local uploads are already happening over a potentially untrusted network (user's browser to SSVM), consider using HTTP instead of HTTPS, or making it configurable via global setting.\n\n**Option 3:** Improve Error Messaging\nIf the upload request fails due to network/SSL issues, show a clear error message suggesting the user check the SSVM certificate or visit the SSVM URL to accept it.\n\n**Option 4:** UI Pre-check\nBefore initiating upload, have the UI make a test request to the SSVM and guide users to accept the certificate if needed.\n\n**Workaround** Before uploading templates via \"Local\" method:\n\n- Get the SSVM public IP from CloudStack (Infrastructure → System VMs)\n- Open https://\u003cSSVM_PUBLIC_IP\u003e/ in your browser\n- Accept the security/certificate warning\n- Return to CloudStack UI and retry the upload\n\nNote: This workaround is session-specific and may need to be repeated after browser restart or cache clearing.","author":{"url":"https://github.com/RosiKyu","@type":"Person","name":"RosiKyu"},"datePublished":"2026-01-21T19:48:16.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/12490/cloudstack/issues/12490"}