Hive beeline with knox gateway is failing

Question

knox service after enabling ssl is failing to start and hive beeline string used

oot@invgcscdp71901 jks]# beeline -u "jdbc:hive2://invgcscdp71901.informatica.com:8443/;ssl=true;sslTrustStore=/opt/cloudera/security/jks/truststore.jks;trustStorePassword=hadoop;transportMode=http;httpPath=gateway/cdp-proxy-api/hive"
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/opt/cloudera/parcels/CDH-7.1.9-1.cdh7.1.9.p1000.55406660/jars/log4j-slf4j-impl-2.18.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/opt/cloudera/parcels/CDH-7.1.9-1.cdh7.1.9.p1000.55406660/jars/slf4j-reload4j-1.7.36.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.apache.logging.slf4j.Log4jLoggerFactory]
WARNING: Use "yarn jar" to launch YARN applications.
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/opt/cloudera/parcels/CDH-7.1.9-1.cdh7.1.9.p1000.55406660/jars/log4j-slf4j-impl-2.18.0.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/opt/cloudera/parcels/CDH-7.1.9-1.cdh7.1.9.p1000.55406660/jars/slf4j-reload4j-1.7.36.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.apache.logging.slf4j.Log4jLoggerFactory]
Connecting to jdbc:hive2://invgcscdp71901.informatica.com:8443/;ssl=true;sslTrustStore=/opt/cloudera/security/jks/truststore.jks;trustStorePassword=hadoop;transportMode=http;httpPath=gateway/cdp-proxy-api/hive
25/03/19 13:17:34 [main]: ERROR jdbc.HiveConnection: Error opening session
org.apache.thrift.transport.TTransportException: HTTP Response code: 404
at org.apache.thrift.transport.THttpClient.flushUsingHttpClient(THttpClient.java:291) ~[hive-exec-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.thrift.transport.THttpClient.flush(THttpClient.java:346) ~[hive-exec-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.thrift.TServiceClient.sendBase(TServiceClient.java:73) ~[hive-exec-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.thrift.TServiceClient.sendBase(TServiceClient.java:62) ~[hive-exec-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.service.rpc.thrift.TCLIService$Client.send_OpenSession(TCLIService.java:143) ~[hive-service-rpc-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.service.rpc.thrift.TCLIService$Client.OpenSession(TCLIService.java:135) ~[hive-service-rpc-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.jdbc.HiveConnection.openSession(HiveConnection.java:1018) ~[hive-jdbc-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.jdbc.HiveConnection.<init>(HiveConnection.java:349) ~[hive-jdbc-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.jdbc.HiveDriver.connect(HiveDriver.java:107) ~[hive-jdbc-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at java.sql.DriverManager.getConnection(DriverManager.java:664) ~[?:1.8.0_442]
at java.sql.DriverManager.getConnection(DriverManager.java:208) ~[?:1.8.0_442]
at org.apache.hive.beeline.DatabaseConnection.connect(DatabaseConnection.java:145) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.DatabaseConnection.getConnection(DatabaseConnection.java:209) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.Commands.connect(Commands.java:1679) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.Commands.connect(Commands.java:1574) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_442]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_442]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_442]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_442]
at org.apache.hive.beeline.ReflectiveCommandHandler.execute(ReflectiveCommandHandler.java:56) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.execCommandWithPrefix(BeeLine.java:1463) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.dispatch(BeeLine.java:1502) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.connectUsingArgs(BeeLine.java:922) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.initArgs(BeeLine.java:804) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.begin(BeeLine.java:1115) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.begin(BeeLine.java:1089) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.mainWithInputRedirection(BeeLine.java:547) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at org.apache.hive.beeline.BeeLine.main(BeeLine.java:529) ~[hive-beeline-3.1.3000.7.1.9.1000-103.jar:3.1.3000.7.1.9.1000-103]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_442]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_442]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_442]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_442]
at org.apache.hadoop.util.RunJar.run(RunJar.java:318) ~[hadoop-common-3.1.1.7.1.9.1000-103.jar:?]
at org.apache.hadoop.util.RunJar.main(RunJar.java:232) ~[hadoop-common-3.1.1.7.1.9.1000-103.jar:?]
25/03/19 13:17:34 [main]: WARN jdbc.HiveConnection: Failed to connect to invgcscdp71901.informatica.com:8443
Error: Could not open client transport with JDBC Uri: jdbc:hive2://invgcscdp71901.informatica.com:8443/;ssl=true;sslTrustStore=/opt/cloudera/security/jks/truststore.jks;trustStorePassword=hadoop;transportMode=http;httpPath=gateway/cdp-proxy-api/hive: Could not establish connection to jdbc:hive2://invgcscdp71901.informatica.com:8443/;ssl=true;sslTrustStore=/opt/cloudera/security/jks/truststore.jks;trustStorePassword=hadoop;transportMode=http;httpPath=gateway/cdp-proxy-api/hive: HTTP Response code: 404 (state=08S01,code=0)

satvaddi · Accepted Answer

TLS Certificate Alias - gateway-identity1

has been already set. beeline string is working

beeline -u "jdbc:hive2://invgcscdp71901.informatica.com:8443/default;ssl=true;sslTrustStore=/var/lib/knox/gateway/data/security/gateway-client-trust.jks;trustStorePassword=changeit;transportMode=http;httpPath=gateway/cdp-proxy-api/hive;user=admin;password=admin"

Scharan · Answer

Hello @satvaddi

From the shared logs I see below error

2025-03-19 12:17:12,085 FATAL knox.gateway (GatewayServer.java:main(195)) - Failed to start gateway: org.apache.knox.gateway.services.ServiceLifecycleException: Public certificate for the gateway cannot be found with the alias invgcscdp71901.informatica.com. Please check the identity certificate alias.
org.apache.knox.gateway.services.ServiceLifecycleException: Public certificate for the gateway cannot be found with the alias invgcscdp71901.informatica.com. Please check the identity certificate alias.

It looks like the newly generated certificate does not have the alias name set as the host FQDN. Please verify the certificate alias name and update it in the Knox configuration at the following path:
CM UI => Knox => Configuration => Security - TLS Certificate Alias (Optional)

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.