Ranger HDFS Policy not Syncing - No Trusted Cert Found

[#1]

Hello,

After rolling out SSL to the Ranger Admin Page, I noticed my policy changes weren't syncing with the name nodes. I found I needed to setup the plugin for SSL. I followed these procedures (https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.0/bk_security/content/ch04s19s02s04s01.html) and had nothing. After looking at the namenode logs I see the error message saying:

com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:149)

I am not quite sure where else to look.

Nick

[#2 · Accepted solution]

@Nick Pileggi

Yes, you will have to put the Ranger Cert into HDFS truststore,. also by default it enables 2 way SSL between Ranger admin and HDFS plug-in.

Some time back I have written article here with complete steps.

https://community.hortonworks.com/articles/68150/configuring-ranger-ranger-hdfs-plugin-for-ssl-with....

[#3]

If you enable SSL on ranger, you need to update the truststore.

Please refer http://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.5.3/bk_security/content/configure_ambari_ranger_...

[#4]

@apappu

That was the hint I needed. It appears I had a keystore set for my HDFS ranger truststore. So no matter what I did, I would be unable to fix it. Once I corrected that issue, I see my namenode pulling the policy. Glad it was something stupid.

Nick