I just recently imported a certificate chain into the keystore that NiFi points to, on 3 NiFi nodes, call them node1, node2 and node3. The truststore.jks file so far has been unedited.   Testing out the SSL handshakes between nodes, I get:   SSL handshake has read 4537 bytes and written 495 bytes ... return code: 0 (ok)     Executed from node 2 requesting node 1 (using the same port configured in NiFi SSL settings in Ambari)   Similarly other combinations also were successful, (node1 -> node2, node3 -> node1, etc.)   However, when after the certificate import and then restarting NiFi, trying the NiFi UI, it shows that the cluster has been disconnected.   Furthermore, it shows that the SSL handshakes are failing:   Attempt to contact NiFi Node https://node2:port/nifi did not complete due to exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Attempt to contact NiFi Node https://node3:port/nifi did not complete due to exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target Attempt to contact NiFi Node https://node1:port/nifi did not complete due to exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.   What is going on here? Why isn't the SSL handshake working through NiFi? ... View more

I'm in the process of renewing the certificates for each node in my Hadoop cluster. I obtained a certificate file for each of my nodes. But when running the following command, I get the error   keytool error: java.lang.Exception: Failed to establish chain from reply”   Command:   sudo keytool -importcert -alias node1 -file node1.cer -keystore keystore.jks     From what I've gathered this happens because I didn't load the root and intermediate CA certificates into the truststore yet.   Looking into the truststore.jks file itself, I can see that I already have root and intermediate CA certificates that are still not expired for a long while. So they've already been loaded.   So is it possible to use these existing root and intermediate CA certificates while importing my new Hadoop node certificate into the keystore?   (Also, I've tried this command alteration but still got the same error:)   sudo keytool -import -alias node1 -trustcacerts -storetype jceks -file node1.cer -keystore keystore.jks     ... View more

2019-10-23 20:42:17,691 - Check db_connection_check was unsuccessful. Exit code: 1. Message: ERROR: Unable to connect to the DB. Please check DB connection properties. org.postgresql.util.PSQLException: Connection refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections. Traceback (most recent call last): File "/var/lib/ambari-agent/cache/custom_actions/scripts/check_host.py", line 546, in <module> CheckHost().execute() File "/usr/lib/ambari-agent/lib/resource_management/libraries/script/script.py", line 375, in execute method(env) File "/var/lib/ambari-agent/cache/custom_actions/scripts/check_host.py", line 207, in actionexecute raise Fail(error_message) resource_management.core.exceptions.Fail: Check db_connection_check was unsuccessful. Exit code: 1. Message: ERROR: Unable to connect to the DB. Please check DB connection properties. org.postgresql.util.PSQLException: Connection refused. Check that the hostname and port are correct and that the postmaster is accepting TCP/IP connections. I followed the steps outlined when you select "Existing PostgreSQL database", namely:     where I used:      sudo yum install postgresql-jdbc   to install the package, and then   ambari-server setup --jdbc-db=postgres --jdbc-driver=/usr/share/java/postgresql-jdbc.jar   And setup completed successfully. I'm making a test cluster with 3 machines on Azure, and cannot setup Hive.. Also I seem to not have a /var/lib/pgsql folder on my Ambari server like people reference in similar problems on the web, if that makes a difference. ... View more