Oracle Analytics Cloud and Server

Home› Oracle Analytics› Oracle Analytics Forums› Oracle Analytics Cloud and Server› Oracle Analytics Cloud and Server

Categories

Welcome to the Oracle Analytics Community: Please complete your User Profile and upload your Profile Picture

Unable to start NodeManager after implementing SSL

Received Response
45
Views
6
Comments
SonPat99
SonPat99 Rank 6 - Analytics Lead
edited Aug 13, 2024 5:56PM in Oracle Analytics Cloud and Server

Dear Gurus,

I am unable to start the NodeManager using "Services" after implementing the SSL on our environment.

Weblogic Version: 10.3.5.0

Error:

<Oct 8, 2017 10:29:52 AM> <INFO> <Loading domains file: D:\OBIEEHome\wlserver_10.3\common\nodemanager\nodemanager.domains>

<Oct 8, 2017 10:29:52 AM> <INFO> <Loading identity key store: FileName=D:\OBIEEHome\ssl\myIdentity_dev.jks, Type=jks, PassPhraseUsed=true>

<Oct 8, 2017 10:29:52 AM> <INFO> <Loaded node manager configuration properties from 'D:\OBIEEH~1\WLSERV~1.3\common\nodemanager\nodemanager.properties'>

<Oct 8, 2017 10:29:52 AM> <INFO> <bifoundation_domain> <backlogserver> <Startup configuration properties loaded from "D:\OBIEEHome\user_projects\domains\bifoundation_domain\servers\backlogserver\data\nodemanager\startup.properties">

<Oct 8, 2017 10:29:52 AM> <INFO> <bifoundation_domain> <backlogserver1> <Startup configuration properties loaded from "D:\OBIEEHome\user_projects\domains\bifoundation_domain\servers\backlogserver1\data\nodemanager\startup.properties">

<Oct 8, 2017 10:29:52 AM> <INFO> <bifoundation_domain> <backlogserver2> <Startup configuration properties loaded from "D:\OBIEEHome\user_projects\domains\bifoundation_domain\servers\backlogserver2\data\nodemanager\startup.properties">

<Oct 8, 2017 10:29:52 AM> <INFO> <bifoundation_domain> <bi_server1> <Startup configuration properties loaded from "D:\OBIEEHome\user_projects\domains\bifoundation_domain\servers\bi_server1\data\nodemanager\startup.properties">

<Oct 8, 2017 10:29:53 AM> <SEVERE> <Fatal error in node manager server>

java.lang.RuntimeException: Cannot convert identity certificate

at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(Unknown Source)

at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)

at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)

at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContextWrapper.java:144)

at weblogic.nodemanager.server.SSLListener.init(SSLListener.java:53)

at weblogic.nodemanager.server.NMServer.start(NMServer.java:206)

at weblogic.nodemanager.server.NMServer.main(NMServer.java:377)

at weblogic.NodeManager.main(NodeManager.java:31)

However, when I am starting the Nodemanager using CMD, I am not getting any error and it is starting properly.

I have referred various links and found that I have to update the nodemanager.properties and setDomainEnv.cmd files to support JSSE. "-Dweblogic.security.SSL.enableJSSE=true"

I have also enabled the JSSE on my Admin and bi_server1 as well as the fail-over servers.

Certificate details:

Signature details: sha256RSA

Environment Details:

Server: Windows 2008 R2

OBIEE: 11.1.1.7

I am trying to use TLS ciphers to make the OBIEE secured.

Also, post following the steps from Oracle link to enable SSL, I am unable to login to analytics.

Request you gurus to kindly guide me in the right direction here.

Answers

  • handat
    handat Rank 5 - Community Champion

    You might need to upgrade to 10.3.6 first and also to latest JDK 1.7.x as JSSE support in 10.3.5 only supported TLS1.0 but not higher, but modern browsers will require TLS1.1+ to allow SSL/TLS handshake.

  • SonPat99
    SonPat99 Rank 6 - Analytics Lead

    Thanks Handat...

    Just a quick check: can I directly go to 12C or I have to first upgrade to 10.3.6 and then to 12.1/12.2?

    Also, with upgrade to 10.3.6, will jdk also gets updated or I will have to manually change the config files to point to the latest JDK (system has 1.8 as the latest JDK)?

    I am assuming that 10.3.6 will be a patch upgrade, right?

  • Gianni Ceresa
    Gianni Ceresa Mod 
    user1137177 wrote:Just a quick check: can I directly go to 12C or I have to first upgrade to 10.3.6 and then to 12.1/12.2?

    Where does "12c" come from?

    10.3.6 is just weblogic, and OBIEE 11g isn't certified on weblogic 12, so you better do not mix these pieces. If you are thinking / talking about moving to OBIEE 12c you can move directly without first update weblogic to 10.3.6 as the migration will not use anything from your weblogic (new 12c weblogic installed with OBIEE 12c).

  • SonPat99
    SonPat99 Rank 6 - Analytics Lead

    Thanks Gianni...

    Yes, there is a plan to move to OBIEE 12C, but it will take a few months and this SSL implementation is required immediately due to audits and stuff...

    Just to do a double check, moving to 10.3.6 will resolve this issue of NodeManager?

    Also, I am not sure how this upgrade and implementation of SSL will impact the LDAPs. Any pointers in this direction will be very helpful.

  • handat
    handat Rank 5 - Community Champion

    You cannot use JDK 1.8 with WLS 10.3.6.  Just install 10.3.6 on top of 10.3.5 and it will detect an existing older version an upgrade appropriately. The JDK upgrade will be separate as you will either need to replace your existing JDK in the same location, or update the weblogic scripts to point to the new JDK.

  • SonPat99
    SonPat99 Rank 6 - Analytics Lead

    Thanks a lot Handat.

    Regarding "need to replace your existing JDK in the same location", how can I achieve this? Is there any documentation for this which I can refer or any other pointers will be very appreciated.

    Regarding "update the weblogic scripts to point to the new JDK.", as per my understanding, these are the files that needs to be updated, right?

    * wlserver_10.3/common/bin/commEnv.sh

    * user_projects/domains/<mydomain>/bin/setDomainEnv.sh

    * wlserver_10.3/common/nodemanager/nodemanager.properties

    * utils/bsu/bsu.sh

    * utils/quickstart/quickstart.sh

    * utils/uninstall/uninstall.sh

    Please point out if I have missed any configuration files.

    I have to update JDK in any condition because the unlimited JCE file for JDK 1.6 is not supporting many of the Ciphers I have to use for SSL TLS implementation.

    Please suggest.