Ambari-agent unable to communicate to ambari server SSL error

[#1]

I am trying to add a node in my cluster. However, after trying to register the new node to the cluster. I am getting the error below while registering it.Ambari version. 2.3.4.7
OS : Ubuntu 14.04

ERROR 2020-04-15 14:10:08,335 NetUtil.py:84 - [Errno 8] _ssl.c:510: EOF occurred in violation of protocol
ERROR 2020-04-15 14:10:08,336 NetUtil.py:85 - SSLError: Failed to connect. Please check openssl library versions.
Refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1022468 for more details.
WARNING 2020-04-15 14:10:08,336 NetUtil.py:112 - Server at https://xxxxxxx:8440 is not reachable, sleeping for 10 seconds...
', None)

Troubleshooting:
- Python version is the same new node and the cluster. I am using python 2.6.
- Added also in ambari-client.ini the security protocol TLSv1.
- Java version is also the same on all node like the new node. I am using java version "1.8.0_92".
- DNS is also properly set. Got positive result when digging fqdn is resolving in the DNS server.
- Host file is also properly set.

Any suggestion is very much appreciated. Thanks in advance.

[#2]

Hi @TR7_BRYLE ,

I am not an Ambari expert but I feel you are definitely on the right track. I wonder if you can check a couple of more things:

1. check what java version/path Ambari agent is using on the host?

2. Then compare the java.security file with the working host to confirm that it allows TLSv1.

Thanks,

Li

[#3]

Hi @lwang 

Thanks for the info. I will double-check the TLSv1 in my java.security. I've remembered that I already set the necessary protocols in my java config. Regarding Java and ambari variables, I confirmed that Ambari using the correct Java version declared in my Java and Ambari variables. Thanks.

[#4]

@TR7_BRYLE 

This issue occurs because the Java is restricting the TLSv1 from (1.8.0-171) used by the Ambari Agents. By default, ambari-agent connects to TLSv1, unless specified by force_https_protocol=PROTOCOL_TLSv1_2 in ambari-agent.ini. Hence, the Ambari- Agent is not able to connect and communicate to Ambari server. 

To resolve this issue, add the following property in ambari-agent.ini [/etc/ambari-agent/conf/ambari-agent.ini] file under [security] and restart ambari-agent.

force_https_protocol=PROTOCOL_TLSv1_2

https://community.cloudera.com/t5/Support-Questions/ambari-agents-cannot-reach-ambari-server-after-c...

Restart the ambari agents

Thanks,

Prakash

[#5]

Hi @Prakashcit .

Thank you for the info. I've already tried this. However, the error still persists after adding this to the configuration of ambari-agent.ini.

Thank you.

[#6]

@TR7_BRYLE  Did we restart the agents after making the changes? can you attach the error stack trace.

[#7]

Hi @Prakashcit 

Yes we restarted the ambari-agent. Here is the error.

ERROR 2020-04-15 14:10:08,335 NetUtil.py:84 - [Errno 8] _ssl.c:510: EOF occurred in violation of protocol
ERROR 2020-04-15 14:10:08,336 NetUtil.py:85 - SSLError: Failed to connect. Please check openssl library versions. 
Refer to: https://bugzilla.redhat.com/show_bug.cgi?id=1022468 for more details.
WARNING 2020-04-15 14:10:08,336 NetUtil.py:112 - Server at https://<hostname>:8440 is not reachable, sleeping for 10 seconds...
', None)
('  File "/usr/lib/python2.6/site-packages/ambari_agent/main.py", line 306, in <module>
    main(heartbeat_stop_callback)
  File "/usr/lib/python2.6/site-packages/ambari_agent/main.py", line 242, in main
    stop_agent()
  File "/usr/lib/python2.6/site-packages/ambari_agent/main.py", line 189, in stop_agent
    sys.exit(1)

[#8 · Accepted solution]

This issue is now resolved. This is due to missing binaries of ambari agent. I just copied all the required binaries.

[#9]

What binaries? I'm having the same problem right now and none of the solutions from the internet are helping.

[#10]

@kobolock If you are seeing the same below error then you can you can try the following solution. 

SSLError: Failed to connect. Please check openssl library versions.

To resolve this issue, add the following property in ambari-agent.ini (/etc/ambari-agent/conf/ambari-agent.ini) file under [security]and restart ambari-agent:
========
[security]
force_https_protocol=PROTOCOL_TLSv1_2

If you found that the provided solution(s) assisted you with your query, please take a moment to login and click Accept as Solution below each response that helped.