Wazuh Dashboard error SSL

[Ian Cabana]

Hi, 

After having issue of space(runout of space) After cleanup file and folder and regain space. My wazuh-dashboard wont connect to the indexer.

It's look like I got issue with cert and/or SSL 

Thanks in advances 

Here my error in log 

Feb  7 16:02:41 wazuh-server opensearch-dashboards: {"type":"log","@timestamp":"2025-02-07T16:02:41Z","tags":["error","opensearch","data"],"pid":4021,"message":"[ConnectionError]: write EPROTO 140708791654272:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n"}
Feb  7 16:02:44 wazuh-server opensearch-dashboards: {"type":"log","@timestamp":"2025-02-07T16:02:44Z","tags":["error","opensearch","data"],"pid":4021,"message":"[ConnectionError]: write EPROTO 140708791654272:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n"}
Feb  7 16:02:46 wazuh-server opensearch-dashboards: {"type":"log","@timestamp":"2025-02-07T16:02:46Z","tags":["error","opensearch","data"],"pid":4021,"message":"[ConnectionError]: write EPROTO 140708791654272:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n"}
Feb  7 16:02:49 wazuh-server opensearch-dashboards: {"type":"log","@timestamp":"2025-02-07T16:02:49Z","tags":["error","opensearch","data"],"pid":4021,"message":"[ConnectionError]: write EPROTO 140708791654272:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ssl3_record.c:332:\n"}

[Aishat Motunrayo Awujola]

Hello Ian,

The error you shared relates to SSL certificate issues. I will need you to verify some things.

Can you please verify that your certificates have the right permissions and are readable by running the below command?

ls -l /etc/wazuh-indexer/certs/

ls -l /etc/wazuh-dashboard/certs/

Also verify that the certificates are valid by running the below:

openssl x509 -in /etc/wazuh-dashboard/certs/dashboard.pem -text -noout

You can share the results of this with me.

Awaiting your feedback.

Regards.

[Ian Cabana]

Hi 

Thank for your reply 

Here is teh result of the ls command 

# ls -l /etc/wazuh-indexer/certs/
total 20
-r-------- 1 wazuh-indexer wazuh-indexer 1704 Sep  6 23:50 admin-key.pem
-r-------- 1 wazuh-indexer wazuh-indexer 1107 Sep  6 23:50 admin.pem
-r-------- 1 wazuh-indexer wazuh-indexer 1184 Sep  6 23:50 root-ca.pem
-r-------- 1 wazuh-indexer wazuh-indexer 1704 Sep  6 23:50 wazuh-indexer-key.pem
-r-------- 1 wazuh-indexer wazuh-indexer 1229 Sep  6 23:50 wazuh-indexer.pem
# ls -l /etc/wazuh-dashboard/certs/
total 12
-r-------- 1 wazuh-dashboard wazuh-dashboard 1184 Sep  6 23:50 root-ca.pem
-r-------- 1 wazuh-dashboard wazuh-dashboard 1704 Sep  6 23:50 wazuh-dashboard-key.pem
-r-------- 1 wazuh-dashboard wazuh-dashboard 1233 Sep  6 23:50 wazuh-dashboard.pem

# openssl x509 -in /etc/wazuh-dashboard/certs/wazuh-dashboard.pem -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            e4:40:b9:4c:c7:eb:e7:8a
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: OU=Wazuh, O=Wazuh, L=California
        Validity
            Not Before: Sep  6 23:50:03 2024 GMT
            Not After : Sep  4 23:50:03 2034 GMT
        Subject: C=US, L=California, O=Wazuh, OU=Wazuh, CN=wazuh-dashboard

Thanks :)

[Aishat Motunrayo Awujola]

Hello,

Can you share the logs for the commands below in text file:

Wazuh Dashboard: journalctl -u wazuh-dashboard | grep -i -E "error|warn"

Wazuh Indexer: cat /var/log/wazuh-indexer/wazuh-cluster.log | grep -i -E "error|warn"

Regards.

[Ian Cabana]

Sure here is the log for dashboard

Feb 07 18:47:05 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:05Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 07 18:47:05 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:05Z","tags":["error","savedobjects-service"],"pid":4020,"message":"Unable to retrieve version information from OpenSearch nodes."}
Feb 07 18:47:08 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:08Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 07 18:47:10 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:10Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 07 18:47:13 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:13Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: connect ECONNREFUSED 127.0.0.1:9200"}
Feb 07 18:47:16 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:16Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:18 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:18Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:20 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:20Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:23 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:23Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:25 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:25Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:28 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:28Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:30 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:30Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss
l3_record.c:332:\n"}
Feb 07 18:47:33 wazuh-server opensearch-dashboards[4020]: {"type":"log","@timestamp":"2025-02-07T18:47:33Z","tags":["error","opensearch","data"],"pid":4020,"message":"[ConnectionError]: write EPROTO 139830859487104:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../deps/openssl/openssl/ssl/record/ss

And it goes on and on for the last msg.

And here it's the indexer..

[2025-02-10T00:00:00,479][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:05,479][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:10,480][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:15,480][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:20,481][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:25,481][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:30,482][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:30,722][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-4]
[2025-02-10T00:00:35,481][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:40,482][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:45,482][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:50,483][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:00:55,483][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:00,484][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:05,484][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:10,484][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:15,485][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:20,485][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:25,486][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:30,486][WARN ][o.o.p.c.u.JsonConverter  ] [node-1] Json Mapping Error: Cannot invoke "java.lang.Long.longValue()" because "this.cacheMaxSize" is null (through reference chain: org.opensearch.performanceanalyzer.collectors.CacheConfigMetricsCollector$CacheMaxSizeStatus["Cache_MaxSize"])
[2025-02-10T00:01:30,721][ERROR][o.o.b.OpenSearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [DefaultDispatcher-worker-1]

Thanks 

[Ian Cabana]

And by the way when I tried 

 curl -k -u admin:********* https://127.0.0.1:9200

I got that error

 curl: (35) OpenSSL/1.0.2k-fips: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

[Aishat Motunrayo Awujola]

Hello,

Can you confirm you’re connecting to the dashboard using https instead of http?

Awaiting your reply.

Regards.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wazuh/cf56930b-4cb3-4bd2-b24f-b08bf8c1a3c4n%40googlegroups.com.

[Ian Cabana]

I confirm. Dashboard connect to indexer(port 9200) with https but doesnt work. with the errors see in precedent post

[Aishat Motunrayo Awujola]

Hello Ian,

Can you test your connection without SSL by running the below:

curl -u admin:password http://127.0.0.1:9200

Share the result of this

[Ian Cabana]

 curl -k -u admin:********* https://127.0.0.1:9200

I got that error

 curl: (35) OpenSSL/1.0.2k-fips: error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol

[Aishat Motunrayo Awujola]

Try with http, what you just shared is https.

[Ian Cabana]

 curl -k -u admin:********** http://127.0.0.1:9200
{
  "name" : "node-1",
  "cluster_name" : "wazuh-cluster",
  "cluster_uuid" : "iyWxBqlFSHmO227lkvme4Q",
  "version" : {
    "number" : "7.10.2",
    "build_type" : "rpm",
    "build_hash" : "0aa3533d9a82a2a9acf03285cc47dfe264c5a15b",
    "build_date" : "2024-10-28T15:29:00.446834Z",
    "build_snapshot" : false,
    "lucene_version" : "9.10.0",
    "minimum_wire_compatibility_version" : "7.10.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"

[Aishat Motunrayo Awujola]

Hello Ian,

What this means is that it is running on HTTP instead of HTTPS which is why the dashboard cannot connect over SSL. There is a potential mismatch in your indexer and dashboard SSL configurations. Please review and verify the configuration in the below files and ensure that the SSL options are correctly set and paths to certificates are valid

/etc/wazuh-dashboard/opensearch_dashboards.yml

/etc/wazuh-indexer/opensearch.yml

Please make this correction and restart the indexer and dashboard. Let me know the result of this.

Regards.

[Zaks Ace]

Hi I am having similar issue 

since the file and output is so long here is document file you can check it 

[Aishat Motunrayo Awujola]

Hello Ian,

Can you share your feedback with me? Did the recommendation work for you?

Regards.

To view this discussion visit https://groups.google.com/d/msgid/wazuh/24870ff4-d00c-44e3-bf58-f1135623ad75n%40googlegroups.com.

[Ian Cabana]

Hi,

I try to re-deploy de certificate with the cert tool from wazuh but it didnt work. I think i make a mistake...

Im not sure one or 2 thing with the tools. !!!

 I will try again today to fix and let you know.

Thanks

[Ian Cabana]

I finally reinstall everything... 

Thanks for the help...