Unable to register a cloud image template with direct download option enabled

[kiranchavala]

problem

Unable to register a cloud image template with direct download option enabled

versions

ACS 4.20.1 . 4.19

The steps to reproduce the bug

1. Register a cloud image template with direct download option enabled

Ubuntu 24.04: https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img
Debian 12: https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
AlmaLinux 8: https://repo.almalinux.org/almalinux/8/cloud/x86_64/images/AlmaLinux-8-GenericCloud-latest.x86_64.qcow2
OpenSUSE 15: https://download.opensuse.org/distribution/leap/15.5/appliances/openSUSE-Leap-15.5-Minimal-VM.x86_64-Cloud.qcow2

2. Exception observed

2025-07-01 05:59:19,553 ERROR [c.c.a.ApiServer] (qtp1390913202-21:[ctx-3cebe65a, ctx-8c1b79c8]) (logid:6f306659) unhandled exception executing api command: [Ljava.lang.String;@15eb3095 com.cloud.utils.exception.CloudRuntimeException: URL: https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2 validation failed on host Host {"id":2,"name":"ref-trl-8752-k-Mol8-kiran-chavala-kvm2","type":"Routing","uuid":"5aeefe1c-7404-40e9-92bf-b5b1445e160c"}
	at com.cloud.template.HypervisorTemplateAdapter.performDirectDownloadUrlValidation(HypervisorTemplateAdapter.java:188)
	at com.cloud.template.HypervisorTemplateAdapter.prepare(HypervisorTemplateAdapter.java:246)
	at com.cloud.template.TemplateManagerImpl.registerTemplate(TemplateManagerImpl.java:374)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
	at org.apache.cloudstack.network.contrail.management.EventUtils$EventInterceptor.invoke(EventUtils.java:105)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:175)
	at com.cloud.event.ActionEventInterceptor.invoke(ActionEventInterceptor.java:52)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:175)
	at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:97)

The issue should have been fixed in the past

#9900
#9086

What to do about it?

There should be no exception when registering cloud image templates as direct download

[weizhouapache]

@kiranchavala
I think direct download template is not related to SSVM

maybe because the URL is redirected ?

$ wget -4 https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
--2025-07-01 09:11:40--  https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
Resolving cloud.debian.org (cloud.debian.org)... 194.71.11.165, 194.71.11.173, 194.71.11.163
Connecting to cloud.debian.org (cloud.debian.org)|194.71.11.165|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://saimei.ftp.acc.umu.se/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2 [following]
--2025-07-01 09:11:40--  https://saimei.ftp.acc.umu.se/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2
Resolving saimei.ftp.acc.umu.se (saimei.ftp.acc.umu.se)... 194.71.11.138
Connecting to saimei.ftp.acc.umu.se (saimei.ftp.acc.umu.se)|194.71.11.138|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 344915968 (329M)
Saving to: ‘debian-12-genericcloud-amd64.qcow2’

debian-12-genericcloud-amd64.qcow2            2%[=>                                                                                       ]   8.52M  10.6MB/s               ^C

[kiranchavala]

Thanks @weizhouapache what about

https://download.cloudstack.org/templates/cloud-images/

Facing the same issue

wget -4 https://download.cloudstack.org/templates/cloud-images/ubuntu/ubuntu-20.04-server-cloudimg-amd64.img
--2025-07-01 13:20:36--  https://download.cloudstack.org/templates/cloud-images/ubuntu/ubuntu-20.04-server-cloudimg-amd64.img
Resolving download.cloudstack.org (download.cloudstack.org)... 79.127.138.17, 79.127.138.21, 79.127.138.15
Connecting to download.cloudstack.org (download.cloudstack.org)|79.127.138.17|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 647883264 (618M)
Saving to: ‘ubuntu-20.04-server-cloudimg-amd64.img’

ubuntu-20.04-server-cloudimg-amd64.img            0%[                                                                                                     ]   2.09M  1.65MB/s

cc @sudo87

[kiranchavala]

Also @weizhouapache If i register the template without direct download option enabled then it gets registered successfully

https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2

How is ssvm is handling the redirection ?

[weizhouapache]

@kiranchavala
so, all templates cannot be registered as direct-download templates, but regular registration works ?

[kiranchavala]

@weizhouapache

http templates link >> direct download >> works fine

https template link >> direct download >> failure

[weizhouapache]

@weizhouapache

http templates link >> direct download >> works fine

https template link >> direct download >> failure

What about http/https templates without direct download ? are they working fine ?

Can you get the server certificate and upload using cmk

(localcloud) 🐱 > upload templatedirectdownloadcertificate 
💩 Missing required parameters:  certificate, hypervisor, name, zoneid

I think we should always trust the default CA trust store (cacerts), and optionally trust all certificates (including self-signed)

[kiranchavala]

@weizhouapache

yes http and https templates without direct download are working fine

Getting the following exception when using the API

openssl s_client -showcerts -servername download.cloudstack.org -connect download.cloudstack.org:443 </dev/null 2>/dev/null | \
awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/{ print }' > cloudstack.pem

(admin) 🐱 > upload templatedirectdownloadcertificate certificate="$(cat cloudstack.pem)" hypervisor=kvm name=dowload zoneid=1b0dfd23-800e-4c72-8231-d0acb36d14f3
🙈 Error: (HTTP 530, error code 9999) Cannot parse the certificate provided, please provide a PEM certificate. Error: Could not parse certificate: java.io.IOException: java.lang.IllegalArgumentException: Illegal base64 character 24

[kiranchavala]

The generated pem file is a valid one

[root@ref-trl-8752-k-Mol8-kiran-chavala-mgmt1 ~]# openssl x509 -in cloudstack.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:cd:bb:dd:f2:b3:4c:8f:c9:19:a3:bb:81:75:17:f2:d1:9d
        Signature Algorithm: ecdsa-with-SHA384
        Issuer: C = US, O = Let's Encrypt, CN = E6
        Validity
            Not Before: Jun 19 20:30:00 2025 GMT
            Not After : Sep 17 20:29:59 2025 GMT
        Subject: CN = 1999714585.rsc.cdn77.org
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:3b:e9:68:8a:01:e3:6d:f2:d3:f5:92:6b:3f:87:
                    7e:8f:3b:d3:8a:a2:42:50:b0:bb:9a:79:b9:f2:19:
                    d9:81:21:ed:51:6a:6e:37:3c:25:68:f0:ee:b2:c7:
                    e1:3d:e3:fc:ea:aa:6e:9a:f9:0c:9a:06:b4:52:6b:
                    c1:c8:e5:1a:aa
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Subject Key Identifier:
                88:B8:0E:50:6A:51:3F:2C:92:B2:9C:FA:CF:5F:3C:56:12:70:4A:B4
            X509v3 Authority Key Identifier:
                keyid:93:27:46:98:03:A9:51:68:8E:98:D6:C4:42:48:DB:23:BF:58:94:D2

            Authority Information Access:
                CA Issuers - URI:http://e6.i.lencr.org/

            X509v3 Subject Alternative Name:
                DNS:1999714585.rsc.cdn77.org, DNS:download.cloudstack.org
            X509v3 Certificate Policies:
                Policy: 2.23.140.1.2.1

            X509v3 CRL Distribution Points:

                Full Name:
                  URI:http://e6.c.lencr.org/30.crl

            CT Precertificate SCTs:
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : CC:FB:0F:6A:85:71:09:65:FE:95:9B:53:CE:E9:B2:7C:
                                22:E9:85:5C:0D:97:8D:B6:A9:7E:54:C0:FE:4C:0D:B0
                    Timestamp : Jun 19 21:28:30.763 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:D2:CB:D5:BD:10:B5:25:23:EC:55:DB:
                                20:BE:74:FE:80:1B:74:FA:6C:47:EE:9A:C5:7F:18:A0:
                                A6:4F:88:C4:90:02:21:00:C7:A5:4E:81:3B:1D:B0:97:
                                DD:63:BF:4B:DC:75:D7:C9:26:3D:82:79:88:75:CC:8F:
                                7D:E3:A3:FD:EB:E1:32:76
                Signed Certificate Timestamp:
                    Version   : v1 (0x0)
                    Log ID    : ED:3C:4B:D6:E8:06:C2:A4:A2:00:57:DB:CB:24:E2:38:
                                01:DF:51:2F:ED:C4:86:C5:70:0F:20:DD:B7:3E:3F:E0
                    Timestamp : Jun 19 21:28:34.743 2025 GMT
                    Extensions: none
                    Signature : ecdsa-with-SHA256
                                30:46:02:21:00:94:EF:DB:D7:0D:C3:4C:53:28:A8:A5:
                                08:8D:A1:B9:F3:4D:C4:35:81:82:F9:F6:9F:50:D4:C4:
                                AD:FB:85:5C:38:02:21:00:E0:7A:E9:CA:5A:09:FA:63:
                                B2:FC:78:41:0B:A6:E0:CB:F7:36:E2:79:32:81:4B:2E:
                                70:19:94:75:05:3B:84:54
    Signature Algorithm: ecdsa-with-SHA384
         30:66:02:31:00:a5:d1:c5:a9:42:f0:0a:d8:55:b6:90:b9:50:
         31:13:f0:b4:78:c4:a2:e1:62:f7:19:20:18:46:ff:0e:6b:2b:
         05:ef:5d:cb:ec:56:02:c8:70:0a:c9:e7:84:1c:51:37:0e:02:
         31:00:82:a8:55:45:49:d5:6c:b9:b3:8f:d8:11:da:66:f6:57:
         8c:17:29:0f:28:2c:01:76:a5:6d:82:6c:92:7e:82:00:01:54:
         04:15:b3:65:29:e0:c3:81:b9:4b:28:9d:e0:5a

[weizhouapache]

@weizhouapache

yes http and https templates without direct download are working fine

Getting the following exception when using the API

openssl s_client -showcerts -servername download.cloudstack.org -connect download.cloudstack.org:443 </dev/null 2>/dev/null | \
awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/{ print }' > cloudstack.pem

(admin) 🐱 > upload templatedirectdownloadcertificate certificate="$(cat cloudstack.pem)" hypervisor=kvm name=dowload zoneid=1b0dfd23-800e-4c72-8231-d0acb36d14f3
🙈 Error: (HTTP 530, error code 9999) Cannot parse the certificate provided, please provide a PEM certificate. Error: Could not parse certificate: java.io.IOException: java.lang.IllegalArgumentException: Illegal base64 character 24

@kiranchavala
you can run the command in bash shell, not in cloudmonkey

cmk upload templatedirectdownloadcertificate certificate="$(cat cloudstack.pem)" hypervisor=kvm name=dowload zoneid=1b0dfd23-800e-4c72-8231-d0acb36d14f3

[kiranchavala]

Thanks @weizhouapache was able to uplaod the certificate but still getting a error , restarted the agent and management service

(admin) 🐱 > list templatedirectdownloadcertificates
{
  "count": 1,
  "directdownloadcertificate": [
    {
      "alias": "dowload",
      "hypervisor": "KVM",
      "id": "d837350a-a216-40fb-9464-d9a5d4534f58",
      "issuer": "CN=E6, O=Let's Encrypt, C=US",
      "serialnum": "SerialNumber: 05:cd:bb:dd:f2:b3:4c:8f:c9:19:a3:bb:81:75:17:f2:d1:9d",
      "subject": "CN=1999714585.rsc.cdn77.org",
      "validity": "From: [Thu Jun 19 20:30:00 UTC 2025] - To: [Wed Sep 17 20:29:59 UTC 2025]",
      "version": "3",
      "zoneid": "1b0dfd23-800e-4c72-8231-d0acb36d14f3",
      "zonename": "ref-trl-8752-k-Mol8-kiran-chavala"
    }
  ]

Logs

2025-07-01 11:29:00,219 DEBUG [c.c.a.t.Request] (AgentManager-Handler-3:[]) (logid:) Seq 2-4394387336406762487: Processing:  { Ans: , MgmtId: 32986019922624, via: 2, Ver: v1, Flags: 10, [{"com.cloud.agent.api.Answer":{"result":"false","details":"com.cloud.utils.exception.CloudRuntimeException: Cannot obtain qcow2 virtual size due to: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at org.apache.cloudstack.direct.download.HttpsDirectTemplateDownloader.getRemoteFileSize(HttpsDirectTemplateDownloader.java:199)
	at org.apache.cloudstack.direct.download.DirectDownloadHelper.getFileSize(DirectDownloadHelper.java:100)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtCheckUrlCommand.execute(LibvirtCheckUrlCommand.java:45)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtCheckUrlCommand.execute(LibvirtCheckUrlCommand.java:29)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:1958)
	at com.cloud.agent.Agent.processRequest(Agent.java:779)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1194)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1351)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1226)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1169)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
	at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:589)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1702)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:224)
	at java.base/java.net.URL.openStream(URL.java:1161)
	at org.apache.cloudstack.direct.download.HttpsDirectTemplateDownloader.getRemoteFileSize(HttpsDirectTemplateDownloader.java:197)
	... 13 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
	... 31 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
	... 36 more
","wait":"0","bypassHostMaintenance":"false"}}] }
2025-07-01 11:29:00,220 DEBUG [c.c.a.t.Request] (qtp698741991-24:[ctx-f0001599, ctx-b6140be1]) (logid:5de79ad6) Seq 2-4394387336406762487: Received:  { Ans: , MgmtId: 32986019922624, via: 2(ref-trl-8752-k-Mol8-kiran-chavala-kvm2), Ver: v1, Flags: 10, { Answer } }
2025-07-01 11:29:00,220 DEBUG [c.c.a.m.ClusteredAgentManagerImpl] (qtp698741991-24:[ctx-f0001599, ctx-b6140be1]) (logid:5de79ad6) Details from executing class org.apache.cloudstack.agent.directdownload.CheckUrlCommand: com.cloud.utils.exception.CloudRuntimeException: Cannot obtain qcow2 virtual size due to: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at org.apache.cloudstack.direct.download.HttpsDirectTemplateDownloader.getRemoteFileSize(HttpsDirectTemplateDownloader.java:199)
	at org.apache.cloudstack.direct.download.DirectDownloadHelper.getFileSize(DirectDownloadHelper.java:100)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtCheckUrlCommand.execute(LibvirtCheckUrlCommand.java:45)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtCheckUrlCommand.execute(LibvirtCheckUrlCommand.java:29)
	at com.cloud.hypervisor.kvm.resource.wrapper.LibvirtRequestWrapper.execute(LibvirtRequestWrapper.java:78)
	at com.cloud.hypervisor.kvm.resource.LibvirtComputingResource.executeRequest(LibvirtComputingResource.java:1958)
	at com.cloud.agent.Agent.processRequest(Agent.java:779)
	at com.cloud.agent.Agent$AgentRequestHandler.doTask(Agent.java:1194)
	at com.cloud.utils.nio.Task.call(Task.java:83)
	at com.cloud.utils.nio.Task.call(Task.java:29)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:383)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:326)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1351)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1226)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1169)
	at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
	at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)
	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:206)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
	at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:589)
	at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:187)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1702)
	at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1626)
	at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:224)
	at java.base/java.net.URL.openStream(URL.java:1161)
	at org.apache.cloudstack.direct.download.HttpsDirectTemplateDownloader.getRemoteFileSize(HttpsDirectTemplateDownloader.java:197)
	... 13 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
	at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
	at java.base/sun.security.validator.Validator.validate(Validator.java:264)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
	at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
	... 31 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
	at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
	at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
	... 36 more

2025-07-01 11:29:00,221 WARN  [o.a.c.m.w.WebhookServiceImpl] (qtp698741991-24:[ctx-f0001599, ctx-b6140be1]) (logid:5de79ad6) Skipping delivering event Event {"description":"{\"details\":\"Id: 215 name: cloud-ubtu1\",\"event\":\"TEMPLATE.CREATE\",\"status\":\"Completed\"}","eventId":null,"eventType":"TEMPLATE.CREATE","eventUuid":null,"resourceType":"VirtualMachineTemplate","resourceUUID":null} to any webhook as account ID is missing
2025-07-01 11:29:00,221 WARN  [o.a.c.f.e.EventDistributorImpl] (qtp698741991-24:[ctx-f0001599, ctx-b6140be1]) (logid:5de79ad6) Failed to publish event [category: ActionEvent, type: TEMPLATE.CREATE] on bus webhookEventBus
2025-07-01 11:29:00,230 ERROR [c.c.a.ApiServer] (qtp698741991-24:[ctx-f0001599, ctx-b6140be1]) (logid:5de79ad6) unhandled exception executing api command: [Ljava.lang.String;@23f24711 com.cloud.utils.exception.CloudRuntimeException: URL: https://download.cloudstack.org/templates/cloud-images/ubuntu/ubuntu-20.04-server-cloudimg-amd64.img validation failed on host Host {"id":2,"name":"ref-trl-8752-k-Mol8-kiran-chavala-kvm2","type":"Routing","uuid":"5aeefe1c-7404-40e9-92bf-b5b1445e160c"}
	at com.cloud.template.HypervisorTemplateAdapter.performDirectDownloadUrlValidation(HypervisorTemplateAdapter.java:188)
	at com.cloud.template.HypervisorTemplateAdapter.prepare(HypervisorTemplateAdapter.java:246)
	at com.cloud.template.TemplateManagerImpl.registerTemplate(TemplateManagerImpl.java:374)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:569)
	at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
	at org.apache.cloudstack.network.contrail.management.EventUtils$EventInterceptor.invoke(EventUtils.java:105)

[weizhouapache]

@kiranchavala
I am able to register templates with direct-download

ACS 4.20.1
OracleLinux 8.6

which version and what OS do you use ? @kiranchavala

[weizhouapache]

@kiranchavala I am able to register templates with direct-download

ACS 4.20.1 OracleLinux 8.6

which version and what OS do you use ? @kiranchavala

Update:
RAW image can be uploaded
QCOW2 image cannot, even after uploading certificate