Fix missing web console service certificate

Summary

When the NoVNC console service cannot find its SSL certificate file at /var/lib/nova/certs/server.pem, the console tab opens but immediately fails with a connection refused error. The novnc_proxy service appears running despite the missing certificate preventing secure connections to virtual machine consoles.

Details

Issues description

Fresh CubeCOS installations may experience console connectivity failures. When users create a virtual machine and attempt to open the console through the web interface, the new console tab opens, but the connection fails immediately.

The novnc_proxy service appears active and running without visible errors in the status output. However, examining the /var/log/nova-novncproxy.log service logs reveals that other CubeCOS nodes cannot find the required SSL certificate file at /var/lib/nova/certs/server.pem.

Error presentation in nova-novncproxy.log

INFO nova.console.websocketproxy [-] xxx.xxx.xxx.xxx: SSL connection but '/var/lib/nova/certs/server.pem' not found

Without this certificate, the novnc_proxy service cannot establish secure connections when users attempt to access the console.

Applicable versions

CubeCOS 3.0.0+

This article applies to environments running CubeCOS version 3.0.0.

Resolution

1. Copy the system certificate to the novnc directory. Run the following command:

   cubectl node exec cp /var/www/certs/server.pem /var/lib/nova/certs/server.pem

2. Restart the console proxy service by running the following command:

   cubectl node exec service openstack-nova-novncproxy restart

3. Confirm the service is running. Run the following command:

   cubectl node exec service openstack-nova-novncproxy status

   The output should show active (running).

4. Attempt console connection through the web interface to verify function.

Additional information

None.