question Re: Renewed TLS Certificates - but browser still shows older one in Archives of Support Questions (Read Only)

Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 16:01:09 GMT

i have renewed the tls certificates and applied on the cloudera manager server but the browser is still showing the older one by looking at the expiry date , tried clearing the browser cache , but still it shows older ones. appreciate for any help

Re: Renewed TLS Certificates - but browser still shows older one

Tomas79 — Tue, 11 Sep 2018 17:33:43 GMT

As far as I know there is no way to extend the TLS certificate validity, so if you created a new certificate, and placed into a truststore make sure the old one is removed.

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 17:39:42 GMT

@Tomas79

i meant i have requested for an new certificate and applied it on the server

Re: Renewed TLS Certificates - but browser still shows older one

Tomas79 — Tue, 11 Sep 2018 17:46:22 GMT

You can try to get the server certificate via openssl command:
openssl s_client -connect <host>
and verify if the certificate is new or old.
If it is new, then your browser or PC has some issues.

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 18:03:37 GMT

@Tomas79,

openssl s_client connect is reading the old certificate ,whereas i have replaced ceritificates with new one under the /opt/cloudera/security/x509 and /opt/cloudera/security/jks path

and i did not happen to notice any heartbeat issue , agents hearbeat are also working fine , i don't see any issues with that

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 18:11:01 GMT

Does it require an restart of the cloudera manager service ?

Re: Renewed TLS Certificates - but browser still shows older one

Tomas79 — Tue, 11 Sep 2018 18:14:39 GMT

Yes of course.Restart the scm and agents.Then two things can happen:

- everything falls apart - your agents will not be able to communicate with the scm server

- all ok - check your certificate with openssl - if it is still old, you are configuing the certificate in the wrong path.

Check also your settings in /etc.

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 18:18:03 GMT

@Tomas79

it should have fallen apart after 15 secs, thats interval at which agents sends heartbeat and i have encountered issues with TLS over the past and when somethig has gone wrong , service would immediately fail and throws error in the log.

this is quite weird though

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 18:21:23 GMT

i could only see new certificate applied on hue UI, hence i'm pretty sure on the path too of other server

Re: Renewed TLS Certificates - but browser still shows older one

Tomas79 — Tue, 11 Sep 2018 18:28:10 GMT

But Hue does not have to be configured the same way as CM. Every component can have his truststore and keystore configured in a different path. Also for example Hue requires "cert" file in PEM format, other components requires JKS - truststores and keystores.

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Tue, 11 Sep 2018 18:42:32 GMT

@Tomas79

point i'm trying to understand is , no matter what format service validates it's certificate...it should get broken in-case of an issue after 15sec interval

Re: Renewed TLS Certificates - but browser still shows older one

Johnny_Bach — Thu, 13 Sep 2018 14:06:24 GMT

agree to @Tomas79 , in restarting the services for new certs to come into effect