We've deployed ELS 7.4.0, everything went well, but we can't access the cerebro web interface. The issue arises during the creation of the SSL context, preventing the server from starting. The 'netstat' command shows that port 5602 is not being listened to. What could be the problem? logs: Dec 20 15:00:29 siem1 cerebro[64696]: [error] p.c.s.AkkaHttpServer - Cannot load SSL context Dec 20 15:00:29 siem1 cerebro[64696]: java.lang.reflect.InvocationTargetException: null Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.ssl.ServerSSLEngine$.createScalaSSLEngineProvider(ServerSSLEngine.scala:116) Dec 20 15:00:29 siem1 cerebro[64696]: Caused by: java.lang.NoSuchFieldError: sha256WithRSAEncryption_oid Dec 20 15:00:29 siem1 cerebro[64696]: at com.typesafe.sslconfig.ssl.FakeKeyStore$KeystoreSettings$.<clinit>(FakeKeyStore.scala:55) Dec 20 15:00:29 siem1 cerebro[64696]: at com.typesafe.sslconfig.ssl.FakeKeyStore.getKeyStoreFilePath(FakeKeyStore.scala:139) Dec 20 15:00:29 siem1 cerebro[64696]: at com.typesafe.sslconfig.ssl.FakeKeyStore.createKeyStore(FakeKeyStore.scala:173) Dec 20 15:00:29 siem1 cerebro[64696]: at com.typesafe.sslconfig.ssl.FakeKeyStore.keyManagerFactory(FakeKeyStore.scala:217) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.ssl.DefaultSSLEngineProvider.createSSLContext(DefaultSSLEngineProvider.scala:65) Dec 20 15:00:29 siem1 cerebro[64696]: [info] p.c.s.AkkaHttpServer - Listening for HTTPS on /0:0:0:0:0:0:0:0:5602 Dec 20 15:00:29 siem1 cerebro[64696]: [warn] p.c.s.s.DefaultSSLEngineProvider - Using generated key with self signed certificate for HTTPS. This should NOT be used in production. Dec 20 15:00:29 siem1 cerebro[64696]: Oops, cannot start the server. Dec 20 15:00:29 siem1 cerebro[64696]: java.lang.reflect.InvocationTargetException Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) Dec 20 15:00:29 siem1 cerebro[64696]: at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.ssl.ServerSSLEngine$.createScalaSSLEngineProvider(ServerSSLEngine.scala:116) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.ssl.ServerSSLEngine$.createSSLEngineProvider(ServerSSLEngine.scala:39) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.sslContext$lzycompute(AkkaHttpServer.scala:245) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.sslContext(AkkaHttpServer.scala:244) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.$anonfun$Http1Encrypted$2(AkkaHttpServer.scala:530) Dec 20 15:00:29 siem1 cerebro[64696]: at scala.Option.map(Option.scala:242) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.Http1Encrypted$lzycompute(AkkaHttpServer.scala:522) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.Http1Encrypted(AkkaHttpServer.scala:520) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServer.<init>(AkkaHttpServer.scala:564) Dec 20 15:00:29 siem1 cerebro[64696]: at play.core.server.AkkaHttpServerProvider.createServer(AkkaHttpServer.scala:665) Dec 20 15:00:29 siem1 cerebro[64696]: at

Hi, Oh, sorry I misunderstood that you were trying to configure SSL. 🙂 By the way, latest version is 7.4.2, so if this is completely fresh installation, you can consider removing it and going with the latest. Anyway in this case it's most likely related to java version, so let's check that: Let's see results of alternatives --display java . We are looking for 11. Something like this. If you need to change it, you can use alternatives --config java . If it's still not working, you can list following: ls -lah /usr/lib/jvm/ You can also list installed packages to see some details: yum info java-11-openjdk-headless.x86_64 tzdata-java

Can't access the cerebro web interface

Diaz

We've deployed ELS 7.4.0, everything went well, but we can't access the cerebro web interface. The issue arises during the creation of the SSL context, preventing the server from starting. The 'netstat' command shows that port 5602 is not being listened to. What could be the problem?

logs:
Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: Dec 20 15:00:29 siem1 cerebro[64696]: [error] p.c.s.AkkaHttpServer - Cannot load SSL context
java.lang.reflect.InvocationTargetException: null
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
at play.core.server.ssl.ServerSSLEngine$.createScalaSSLEngineProvider(ServerSSLEngine.scala:116)
Caused by: java.lang.NoSuchFieldError: sha256WithRSAEncryption_oid
at com.typesafe.sslconfig.ssl.FakeKeyStore$KeystoreSettings$.<clinit>(FakeKeyStore.scala:55)
at com.typesafe.sslconfig.ssl.FakeKeyStore.getKeyStoreFilePath(FakeKeyStore.scala:139)
at com.typesafe.sslconfig.ssl.FakeKeyStore.createKeyStore(FakeKeyStore.scala:173)
at com.typesafe.sslconfig.ssl.FakeKeyStore.keyManagerFactory(FakeKeyStore.scala:217)
at play.core.server.ssl.DefaultSSLEngineProvider.createSSLContext(DefaultSSLEngineProvider.scala:65)
[info] p.c.s.AkkaHttpServer - Listening for HTTPS on /0:0:0:0:0:0:0:0:5602
[warn] p.c.s.s.DefaultSSLEngineProvider - Using generated key with self signed certificate for HTTPS. This should NOT be used in production.
Oops, cannot start the server.
java.lang.reflect.InvocationTargetException
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
at play.core.server.ssl.ServerSSLEngine$.createScalaSSLEngineProvider(ServerSSLEngine.scala:116)
at play.core.server.ssl.ServerSSLEngine$.createSSLEngineProvider(ServerSSLEngine.scala:39)
at play.core.server.AkkaHttpServer.sslContext$lzycompute(AkkaHttpServer.scala:245)
at play.core.server.AkkaHttpServer.sslContext(AkkaHttpServer.scala:244)
at play.core.server.AkkaHttpServer.$anonfun$Http1Encrypted$2(AkkaHttpServer.scala:530)
at scala.Option.map(Option.scala:242)
at play.core.server.AkkaHttpServer.Http1Encrypted$lzycompute(AkkaHttpServer.scala:522)
at play.core.server.AkkaHttpServer.Http1Encrypted(AkkaHttpServer.scala:520)
at play.core.server.AkkaHttpServer.<init>(AkkaHttpServer.scala:564)
at play.core.server.AkkaHttpServerProvider.createServer(AkkaHttpServer.scala:665)
at

SzymonC

I see. In general SSL config for cerebro is placed in /opt/cerebro/conf/application.conf.
Did this work with SSL before update?
Also - are you sure your database API is working on SSL (you can check it in /etc/elasticsearch/elasticsearch.yml)?

Diaz

SzymonC Good morning! No, we didn’t update, we immediately installed version 7.4.0 for the customer. Could this be done or should I start the installation from an earlier version?
ssl configuration is commented out, default login password is used for access
aplication.conf:

elasticsearch:yml:

SzymonC

Hi,
Oh, sorry I misunderstood that you were trying to configure SSL. 🙂 By the way, latest version is 7.4.2, so if this is completely fresh installation, you can consider removing it and going with the latest.

Anyway in this case it's most likely related to java version, so let's check that:

Let's see results of alternatives --display java. We are looking for 11. Something like this.
If you need to change it, you can use alternatives --config java.
If it's still not working, you can list following: ls -lah /usr/lib/jvm/
You can also list installed packages to see some details: yum info java-11-openjdk-headless.x86_64 tzdata-java