Unable to start NodeManager after implementing SSL

Question

Dear Gurus, I am unable to start the NodeManager using "Services" after implementing the SSL on our environment. Weblogic Version: 10.3.5.0 Error: java.lang.RuntimeException: Cannot convert identity certificate at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(Unknown Source) at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source) at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source) at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContextWrapper.java:144) at weblogic.nodemanager.server.SSLListener.init(SSLListener.java:53) at weblogic.nodemanager.server.NMServer.start(NMServer.java:206) at weblogic.nodemanager.server.NMServer.main(NMServer.java:377) at weblogic.NodeManager.main(NodeManager.java:31) However, when I am starting the Nodemanager using CMD, I am not getting any error and it is starting properly. I have referred various links and found that I have to update the nodemanager.properties and setDomainEnv.cmd files to support JSSE. "-Dweblogic.security.SSL.enableJSSE=true" I have also enabled the JSSE on my Admin and bi_server1 as well as the fail-over servers. Certificate details: Signature details: sha256RSA Environment Details: Server: Windows 2008 R2 OBIEE: 11.1.1.7 I am trying to use TLS ciphers to make the OBIEE secured. Also, post following the steps from Oracle link to enable SSL, I am unable to login to analytics. Request you gurus to kindly guide me in the right direction here.

SonPat99 · Answer

Thanks a lot Handat.

Regarding "need to replace your existing JDK in the same location", how can I achieve this? Is there any documentation for this which I can refer or any other pointers will be very appreciated.

Regarding "update the weblogic scripts to point to the new JDK.", as per my understanding, these are the files that needs to be updated, right?

* wlserver_10.3/common/bin/commEnv.sh

* user_projects/domains/<mydomain>/bin/setDomainEnv.sh

* wlserver_10.3/common/nodemanager/nodemanager.properties

* utils/bsu/bsu.sh

* utils/quickstart/quickstart.sh

* utils/uninstall/uninstall.sh

Please point out if I have missed any configuration files.

I have to update JDK in any condition because the unlimited JCE file for JDK 1.6 is not supporting many of the Ciphers I have to use for SSL TLS implementation.

Please suggest.

handat · Answer

You cannot use JDK 1.8 with WLS 10.3.6.  Just install 10.3.6 on top of 10.3.5 and it will detect an existing older version an upgrade appropriately. The JDK upgrade will be separate as you will either need to replace your existing JDK in the same location, or update the weblogic scripts to point to the new JDK.

SonPat99 · Answer

Thanks Gianni...

Yes, there is a plan to move to OBIEE 12C, but it will take a few months and this SSL implementation is required immediately due to audits and stuff...

Just to do a double check, moving to 10.3.6 will resolve this issue of NodeManager?

Also, I am not sure how this upgrade and implementation of SSL will impact the LDAPs. Any pointers in this direction will be very helpful.