Solved: PI 3.2.2 can't download updates

patoberli · ‎01-04-2018

Hi all

I would like to install the latest hotfix offered in my PI 3.2.2 installation (PI_3_2_2_update_01-1.0.8.ubf) but Prime throws the following error:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Do you also get this error?

This happens when I click the Download button in the PI Software Updates interface.

patoberli · ‎03-01-2018

Just found this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh32926

There is also a workaround:

Open a TAC service request to have the certificate file QuoVadis_Root_CA2.pem posted through the Special File Posting process. Once you have it, transfer the file to a location on your Prime Infrastructure server that has a repository defined, such as /localdisk/defaultRepo, then manually upload the file from local storage using the following command:

ncs key importcacert QuoVadis_Root_CA2.pem repository 

For example:
ncs key importcacert admin QuoVadis_Root_CA2.pem repo defaultRepo

After uploading the certificate, restart Prime Infrastructure with "ncs stop" and "ncs start", or navigate to Administration > System Settings > Server, and click the "Restart Prime Infrastructure..." button. You can close your TAC service request after successfully completing this workaround using the tools at https://mycase.cloudapps.cisco.com/case

Please note, you could probably also download the original root cert from here: https://www.quovadisglobal.ch/Repository/DownloadRootsAndCRL.aspx

View solution in original post

marce1000 · ‎01-04-2018

- This is a JAVA error, clearly someone messed up, (contact TAC); you could as a workaround download the ubf from cisco.com and install it manually.

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

patoberli · ‎01-04-2018

Yeah, I guess it's a certificate issue. Probably an expired or somewhat hardcoded and exchanged one.

Does the download functionality work for you?

marce1000 · ‎01-04-2018

- No, I get the same error , indeed, ; as stated you could try the manual download and install

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

BillJensen · ‎01-04-2018

Was their a fix for the issue?

patoberli · ‎01-04-2018

So far not. The workaround is to manually download the update from the Cisco Download site (https://software.cisco.com/download/release.html?mdfid=286313442&flowid=&softwareid=284272933&release=3.2.2&relind=AVAILABLE&rellifecycle=&reltype=latest) and upload it to the PI. Just did that 5 minutes ago and it's installing it now.

BillJensen · ‎01-04-2018

thanks for the update

patoberli · ‎01-04-2018

Update just successfully installed. For whatever reason it didn't take the "usual" 60-90 minutes, but just 20.

BillJensen · ‎01-04-2018

I was able to upload a 4g file to this server yesterday with tftp but today when I try it it gives me this error.

The file today is .03mb.

va-cpi-p/admin# copy tftp://10.11.1.19//InstallerUpdateBE-1.0.5.tar.gz disk://defaultRepo
Error code 2: Access violation

BillJensen · ‎01-04-2018

Did something on the CPI Server change with the upgrade from 3.1.0 to 3.2.2?
My tftp server on my macbook pro didn't change and I was able to copy a file yesterday using
va-cpi-p/admin# copy tftp://10.11.1.19//PI-Upgrade-3.X_to_3.2.0.0.258.tar.gz disk://defaultRepo

patoberli · ‎01-05-2018

Possibly, but please open another thread for your issue.

marce1000 · ‎01-04-2018

- Actually , if you look at the release notes, of the ubf, in the install procedure , ONLY the manual download is mentioned. It's not sure wether this must be seen as a requirement,one could argue; it should then not be advertised in the prime->administration -> download center , but then one could be abstinated of it's existence too...

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

patoberli · ‎01-04-2018

True, but it also doesn't work for my outstanding Device Package update ;)

marce1000 · ‎01-04-2018

- Does this then give the same errors ?

M.

-- ' 'Good body every evening' ' this sentence was once spotted on a logo at the entrance of a Weight Watchers Club !

patoberli · ‎01-04-2018

Yes, exactly the same error, even after restarting the PI service.
Btw. the password change link for the Cisco account inside PI is also broken, points to: http://rpf.cloudapps.cisco.com/RPF/passwordreset.do which throws this error:
JBWEB000065: HTTP Status 404 - /RPF/passwordreset.do
JBWEB000309: type JBWEB000067: Status report

JBWEB000068: message /RPF/passwordreset.do

JBWEB000069: description JBWEB000124: The requested resource is not available.