Skip to main content
yagoaparecidoti
yagoaparecidoti
Gold ⭐️
February 28, 2022
Question

Cloudera Manager - javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

We are trying to create self-signed certificates

when applying the settings in the cloudera manager, it returns the error below in the log "/var/log/cloudera-scm-server/cloudera-scm-server.log":

 

2022-02-28 15:55:29,205 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,205 WARN 1655534592@scm-web-47:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,234 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:29,419 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:30,167 WARN 1719302079@scm-web-42:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 81046291@scm-web-48:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
2022-02-28 15:55:33,937 WARN 1687785507@scm-web-45:org.mortbay.log: javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

 

with the server.jks file a server.cer file is exported

 

with this file server.cer is imported to jssecacerts

 

certificate creation is performed on all hosts at the same time

 

in the end all hosts have the same jssecacerts file

8 replies

araujo
Platinum ⭐️⭐️⭐️
araujo
Platinum ⭐️⭐️⭐️
February 28, 2022

@yagoaparecidoti ,

 

Could explain which steps you took to generate your server.jks file?

 

André

 

Translate
-- Was your question answered? Please take some time to click on "Accept as Solution" below this post. If you find a reply useful, say thanks by clicking on the thumbs up button.
yagoaparecidoti
yagoaparecidotiAuthor
Gold ⭐️
March 1, 2022

hi @araujo 

 

we create server.jsk this way:

 

/usr/lib/jvm/jre/bin/keytool -genkeypair -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -keyalg RSA -alias $(hostname -f) -dname "CN=$(hostname -f),OU=Pereira,L=Sao Paulo,ST=Sao Paulo,C=BR" -ext san=dns:$(hostname -f) -ext EKU=serverAuth,clientAuth -validity 730 -storepass 'password22@' -keypass 'password22@'

 

so we create the server.cer like this:

 

/usr/lib/jvm/jre/bin/keytool -export -alias $(hostname -f) -keystore /opt/cloudera/security/pki_2022_v2/$(hostname -f).jks -rfc -file /opt/cloudera/security/pki_2022_v2/$(hostname -f).cer

 

so we import all server.cer from all hosts to jssecacerts file like this:

 

/usr/lib/jvm/jre/bin/keytool -import -file /opt/cloudera/security/pki_2022_v2/server.cer -alias $i -keystore /opt/cloudera/security/pki_2022_v2/jssecacerts -storepass 'password22@'

Translate
araujo
Platinum ⭐️⭐️⭐️
araujo
Platinum ⭐️⭐️⭐️
March 1, 2022

@yagoaparecidoti 

 

Are you able to access Cloudera Manager from your browser?

 

André

 

Translate
-- Was your question answered? Please take some time to click on "Accept as Solution" below this post. If you find a reply useful, say thanks by clicking on the thumbs up button.
VidyaSargur
Community Manager
VidyaSargur
Community Manager
March 7, 2022

@yagoaparecidoti, Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. 

Translate
Regards, Vidya Sargur, Community Manager Was your question answered? Make sure to mark the answer as the accepted solution. If you find a reply useful, say thanks by clicking on the thumbs up button.
Terms & ConditionsAccessibility statement