question Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown in Support Questions

Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

yagoaparecidoti — Mon, 28 Feb 2022 19:57:33 GMT

We are trying to create self-signed certificates

when applying the settings in the cloudera manager, it returns the error below in the log "/var/log/cloudera-scm-server/cloudera-scm-server.log":

2022-02-28 15:55:29,205 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1655534592@scm-web-47:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,234 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,419 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:30,167 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 1687785507@scm-web-45:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

with the server.jks file a server.cer file is exported

with this file server.cer is imported to jssecacerts

certificate creation is performed on all hosts at the same time

in the end all hosts have the same jssecacerts file

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

araujo — Mon, 28 Feb 2022 23:50:48 GMT

@yagoaparecidoti ,

Could explain which steps you took to generate your server.jks file?

André

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

yagoaparecidoti — Tue, 01 Mar 2022 00:00:09 GMT

hi @araujo

we create server.jsk this way:

/usr/lib/jvm/jre/bin/keytool -genkeypair -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -keyalg RSA -alias $(hostname -f) -dname "CN=$(hostname -f),OU=Pereira,L=Sao Paulo,ST=Sao Paulo,C=BR" -ext san=dns:$(hostname -f) -ext EKU=serverAuth,clientAuth -validity 730 -storepass 'password22@' -keypass 'password22@'

so we create the server.cer like this:

/usr/lib/jvm/jre/bin/keytool -export -alias $(hostname -f) -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -rfc -file /opt/cloudera/security/pki_2022_v2/$(hostname -f).cer

so we import all server.cer from all hosts to jssecacerts file like this:

/usr/lib/jvm/jre/bin/keytool -import -file /opt/cloudera/security/pki_2022_v2/server.cer -alias $i -keystore /opt/cloudera/security/pki_2022_v2/jssecacerts -storepass 'password22@'

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

araujo — Tue, 01 Mar 2022 00:21:37 GMT

@yagoaparecidoti

Are you able to access Cloudera Manager from your browser?

André

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

yagoaparecidoti — Wed, 02 Mar 2022 15:33:23 GMT

Hi @araujo

yes, normally

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

araujo — Thu, 03 Mar 2022 01:21:50 GMT

@yagoaparecidoti ,

Is there a correlation between the times when these messages appear in the log and your browser activity?

If all Cloudera Manager tabs in the browser are closed does the error continue to happen?

Cheers,

André

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

yagoaparecidoti — Thu, 03 Mar 2022 01:30:50 GMT

Hi @araujo

after logging into Cloudera Manager, the error already appears.

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

araujo — Thu, 03 Mar 2022 02:21:20 GMT

@yagoaparecidoti ,

Can you try importing your cluster certificate into your browser and see if the error stops? Make sure the certificate is marked as trusted so that the padlock in the browser is green or doesn't show any alerts.

Another thing you can try is to add the following user extensions to your keytool command when creating the self-signed certificate.

-ext KU=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment

Please keep me posted.

Cheers,

André

Re: Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

VidyaSargur — Mon, 07 Mar 2022 05:29:11 GMT

@yagoaparecidoti, Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.