By: Alvaro Villanueva user 16 Sep 2021 at 6:59 a.m. CDT

3 Responses
Alvaro Villanueva gravatar
Expected behavior: Opendj starts listening for the persistence job to ingest data into LDAPs backend. Current behavior: It appears that the certificates are not being regenerated in the opendj instance Steps to reproduce: The installation is being done through Kubernetes and Helm Charts. The config Job logs as usual, but when it comes with the opendj the certificates do not appear in the path /etc/certs and ends all connections. Logs Opendj: ``` INFO - pygluu.containerlib.wait - 2021-09-16 11:47:31,061 - Config is ready INFO - pygluu.containerlib.wait - 2021-09-16 11:47:31,141 - Secret is ready INFO - entrypoint - 2021-09-16 11:47:31,975 - Syncing OpenDJ certs. INFO - entrypoint - 2021-09-16 11:47:35,413 - Checking certificate's Subject Alt Name (SAN) WARNING - ldap_peer - 2021-09-16 11:47:36,148 - Auto replication is disabled; skipping server registration WARNING - ldap_replicator - 2021-09-16 11:47:37,051 - Auto replication is disabled; skipping replication check [16/Sep/2021:11:47:40 +0000] category=CORE severity=NOTICE msgID=134 msg=Wren:DS Server 4.0.0-M3 (build 20190729080147, revision number 4dc791965aa1e038953363ca26db0b64b2216891) starting up [16/Sep/2021:11:47:43 +0000] category=JVM severity=NOTICE msgID=21 msg=Installation Directory: /opt/opendj [16/Sep/2021:11:47:43 +0000] category=JVM severity=NOTICE msgID=23 msg=Instance Directory: /opt/opendj [16/Sep/2021:11:47:43 +0000] category=JVM severity=NOTICE msgID=17 msg=JVM Information: 1.8.0_212-b04 by IcedTea, 64-bit architecture, 1982660608 bytes heap size [16/Sep/2021:11:47:43 +0000] category=JVM severity=NOTICE msgID=18 msg=JVM Host: serv4eo-opendj-init-ss-0.opendj.default.svc.cluster.local, running Linux 3.10.0-1160.21.1.el7.x86_64 amd64, 8201150464 bytes physical memory size, number of processors available 1 [16/Sep/2021:11:47:43 +0000] category=JVM severity=NOTICE msgID=19 msg=JVM Arguments: "-Dorg.opends.server.scriptName=start-ds" [16/Sep/2021:11:47:45 +0000] category=BACKEND severity=NOTICE msgID=513 msg=The database backend site containing 2 entries has started [16/Sep/2021:11:47:45 +0000] category=BACKEND severity=NOTICE msgID=513 msg=The database backend metric containing 2 entries has started [16/Sep/2021:11:47:45 +0000] category=BACKEND severity=NOTICE msgID=513 msg=The database backend userRoot containing 208 entries has started [16/Sep/2021:11:47:46 +0000] category=EXTENSIONS severity=NOTICE msgID=221 msg=DIGEST-MD5 SASL mechanism using a server fully qualified domain name of: id4eo-opendj-init-ss-0.opendj.default.svc.cluster.local [16/Sep/2021:11:47:46 +0000] category=PROTOCOL severity=ERROR msgID=1527 msg=No usable key was found for 'LDAPS Connection Handler'. Verify the keystore content [16/Sep/2021:11:47:46 +0000] category=PROTOCOL severity=WARNING msgID=1528 msg=Disabling LDAPS Connection Handler [16/Sep/2021:11:47:46 +0000] category=PROTOCOL severity=ERROR msgID=1526 msg=The key with alias '[demoexample.gluu.org]' was not found for 'LDAPS Connection Handler'. Verify that the keystore is properly configured [16/Sep/2021:11:47:46 +0000] category=PROTOCOL severity=WARNING msgID=1528 msg=Disabling LDAPS Connection Handler [16/Sep/2021:11:47:46 +0000] category=CORE severity=NOTICE msgID=139 msg=The Directory Server has sent an alert notification generated by class org.opends.server.core.DirectoryServer (alert type org.opends.server.DirectoryServerShutdown, alert ID org.opends.messages.core-141): The Directory Server has started the shutdown process. The shutdown was initiated by an instance of class org.opends.server.core.DirectoryServer and the reason provided for the shutdown was An error occurred while trying to start the Directory Server: ConfigException: An error occurred while trying to initialize a connection handler loaded from class org.forgerock.opendj.reactive.LDAPConnectionHandler2 with the information in configuration entry cn=LDAPS Connection Handler,cn=Connection Handlers,cn=config: InitializationException: An error occurred while attempting to initialize the SSL context for use in the LDAP Connection Handler: An error occurred while trying to load the keystore contents from file /etc/certs/opendj.pkcs12: IOException(keystore password was incorrect) (id=org.opends.messages.extension-62) (LDAPConnectionHandler2.java:487 LDAPConnectionHandler2.java:101 ConnectionHandlerConfigManager.java:311 ConnectionHandlerConfigManager.java:244 DirectoryServer.java:1753 DirectoryServer.java:1483 DirectoryServer.java:5035). This connection handler will be disabled (ConnectionHandlerConfigManager.java:319 ConnectionHandlerConfigManager.java:244 DirectoryServer.java:1753 DirectoryServer.java:1483 DirectoryServer.java:5035) [16/Sep/2021:11:47:46 +0000] category=BACKEND severity=NOTICE msgID=370 msg=The backend userRoot is now taken offline [16/Sep/2021:11:47:46 +0000] category=BACKEND severity=NOTICE msgID=370 msg=The backend site is now taken offline [16/Sep/2021:11:47:46 +0000] category=BACKEND severity=NOTICE msgID=370 msg=The backend metric is now taken offline [16/Sep/2021:11:47:46 +0000] category=CORE severity=NOTICE msgID=203 msg=The Directory Server is now stopped ```

By Mohammad Abudayyeh staff 16 Sep 2021 at 7:29 a.m. CDT

Mohammad Abudayyeh gravatar
Hello Alvaro, It seems your secrets got curropted by user modificaiton or you may have deleted them. Rotate your opendj certs. Unfortunately, we cannot continue to help you as you are required to signup for a support plan for the cloud native distribution. This ticket will be closed. Thanks, Mohammad

By Alvaro Villanueva user 16 Sep 2021 at 8:34 a.m. CDT

Alvaro Villanueva gravatar
Hi Mohammad. Thank you for your reply and hint. We had already figured that some cert rotation was needed, but we are not understanding how to proceed with that, since the opendj pod crashes before we are able to connect to it and perform the needed actions. Can you please help us understand how to solve this? Thank you

By Michael Schwartz Account Admin 16 Sep 2021 at 10:10 a.m. CDT

Michael Schwartz gravatar
As Mo says, you need a support contract for cloud native support. Please book a meeting on https://gluu.org/booking if VIP support may be an option for your organization.