Unable to connect to the graphic server

'Unable to connect to the graphic server' error when opening SPICE console

问题

?The below error message is shown when trying to connect to any virtual machine

?There are no firewall restrictions in place, telnet to SPICE ports works from the same machine, the SPICE client is up to date.

环境

?Red Hat Enterprise Virtualization 3.2

决议

?Verify existence of /etc/pki/ovirt-engine/ca.pem and the permissions:

?The ca.pem should exist and be owned by user ovirt and group ovirt. If this is correct, verify it is the same certificate as the one in/etc/pki/vdsm/libvirt-spice/ on the

hypervisors.

?If the files are absent or different, copy ca.pem from manager to affected hypervisors.

根源

?The manager process cannot access the internal CA

certificate /etc/pki/ovirt-engine/ca.pem.

?This file is needed by the SPICE client and is transmitted by the manager on connect time. If it does not exist, SSL handshake fails and the connection drops.

诊断步骤

?custom certificates were installed for the web interface they were installed a few months ago and worked fine the last action done to the env was an upgrade of the

hypervisors clients are windows machines, spice client is 0.5.3-28.el6ev

?engine.log on the manager contains this line:

?

?

?telnet hypervisors works from the client on SPICE ports ?tcpdump contains brief traffic exchange before the error