Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

[#1]

We are trying to create self-signed certificates

when applying the settings in the cloudera manager, it returns the error below in the log "/var/log/cloudera-scm-server/cloudera-scm-server.log":

2022-02-28 15:55:29,205 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1655534592@scm-web-47:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,234 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,419 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:30,167 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 1687785507@scm-web-45:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

with the server.jks file a server.cer file is exported

with this file server.cer is imported to jssecacerts

certificate creation is performed on all hosts at the same time

in the end all hosts have the same jssecacerts file

[#2]

@yagoaparecidoti ,

Could explain which steps you took to generate your server.jks file?

André

[#3]

hi @araujo 

we create server.jsk this way:

/usr/lib/jvm/jre/bin/keytool -genkeypair -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -keyalg RSA -alias $(hostname -f) -dname "CN=$(hostname -f),OU=Pereira,L=Sao Paulo,ST=Sao Paulo,C=BR" -ext san=dns:$(hostname -f) -ext EKU=serverAuth,clientAuth -validity 730 -storepass 'password22@' -keypass 'password22@'

so we create the server.cer like this:

/usr/lib/jvm/jre/bin/keytool -export -alias $(hostname -f) -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -rfc -file /opt/cloudera/security/pki_2022_v2/$(hostname -f).cer

so we import all server.cer from all hosts to jssecacerts file like this:

/usr/lib/jvm/jre/bin/keytool -import -file /opt/cloudera/security/pki_2022_v2/server.cer -alias $i -keystore /opt/cloudera/security/pki_2022_v2/jssecacerts -storepass 'password22@'

[#4]

@yagoaparecidoti 

Are you able to access Cloudera Manager from your browser?

André

[#5]

Hi @araujo 

yes, normally

[#6]

@yagoaparecidoti ,

Is there a correlation between the times when these messages appear in the log and your browser activity?

If all Cloudera Manager tabs in the browser are closed does the error continue to happen?

Cheers,

André

[#7]

Hi @araujo 

after logging into Cloudera Manager, the error already appears.

[#8]

@yagoaparecidoti ,

Can you try importing your cluster certificate into your browser and see if the error stops? Make sure the certificate is marked as trusted so that the padlock in the browser is green or doesn't show any alerts.

Another thing you can try is to add the following user extensions to your keytool command when creating the self-signed certificate.

-ext KU=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment

Please keep me posted.

Cheers,

André

[#9]

@yagoaparecidoti, Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future.