ReDBox and DOI minting via ANDS DataCite service

[Christopher McAvaney]

G'day all,

We have discovered an issue with this service (which has been rock solid for a while now).
It is crashing and showing a SSL handshake error:
2017-07-14 11:52:56,846 ERROR namicPageServiceImpl Error during HTTP request:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

So, I am wondering if this is a ReDBox issue or an ANDS issue (I have a query in with ANDS at the moment too).

Has anybody else hit this issue?

Regards,
Christopher

[Andrew Brazzatti]

Hi Christopher,

I wasn't able to replicate the issue but SSL Handshake errors are usually much lower level than the app itself so I'm thinking if this issue might be at the JVM level.

You might be able to add  -Djavax.net.debug=all to this part of your tf_env.sh to get some more logging about whats happening.

Some info in SSL debugging http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/ReadDebug.html

Thanks,
Andrew

--
-- Website: http://www.redboxresearchdata.com.au
 
You received this message because you are subscribed to the Google Groups ReDBox group. To post to this group, send email to redbo...@googlegroups.com. To unsubscribe from this group, send email to redbox-repo+unsubscribe@googlegroups.com. For more options, visit this group at https://groups.google.com/d/forum/redbox-repo?hl=en
---
You received this message because you are subscribed to the Google Groups "ReDBox" group.
To unsubscribe from this group and stop receiving emails from it, send an email to redbox-repo+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Christopher McAvaney]

Yeah - I am thinking more debug required.

Thanks for your high level diagnosis.

Regards,

Christopher

On Friday, 14 July 2017 14:04:02 UTC+10, andrew wrote:

Hi Christopher,

I wasn't able to replicate the issue but SSL Handshake errors are usually much lower level than the app itself so I'm thinking if this issue might be at the JVM level.

You might be able to add  -Djavax.net.debug=all to this part of your tf_env.sh to get some more logging about whats happening.

Some info in SSL debugging http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/ReadDebug.html

Thanks,
Andrew

On Fri, Jul 14, 2017 at 1:06 PM, Christopher McAvaney <christophe...@deakin.edu.au> wrote:

G'day all,

We have discovered an issue with this service (which has been rock solid for a while now).
It is crashing and showing a SSL handshake error:
2017-07-14 11:52:56,846 ERROR namicPageServiceImpl Error during HTTP request:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

So, I am wondering if this is a ReDBox issue or an ANDS issue (I have a query in with ANDS at the moment too).

Has anybody else hit this issue?

Regards,
Christopher

--
-- Website: http://www.redboxresearchdata.com.au
 

You received this message because you are subscribed to the Google Groups ReDBox group. To post to this group, send email to redbo...@googlegroups.com. To unsubscribe from this group, send email to redbox-repo...@googlegroups.com. For more options, visit this group at https://groups.google.com/d/forum/redbox-repo?hl=en

---
You received this message because you are subscribed to the Google Groups "ReDBox" group.

To unsubscribe from this group and stop receiving emails from it, send an email to redbox-repo...@googlegroups.com.

[Grant Jackson]

Hi Christopher,

Did you ever resolve this issue? It appears that we have a similar (but not identical) SSL error affecting the ReDBox connection to the ANDS DataCite service.


2017-11-07 14:08:12,874          ERROR  namicPageServiceImpl Error during HTTP request:
javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair


Ours has previously been working fine, but I suspect we have not minted a DOI since your post. Thank you.

Cheers, Grant

You received this message because you are subscribed to the Google Groups ReDBox group. To post to this group, send email to redbo...@googlegroups.com. To unsubscribe from this group, send email to redbox-repo+unsubscribe@googlegroups.com. For more options, visit this group at https://groups.google.com/d/forum/redbox-repo?hl=en

---
You received this message because you are subscribed to the Google Groups "ReDBox" group.

To unsubscribe from this group and stop receiving emails from it, send an email to redbox-repo+unsubscribe@googlegroups.com.

[Matthew Mulholland]

Hi Grant, Chris

I'm not sure if related, but I have seen issues like this before, with SSL handshakes  when using an older version of java, where there were limits were placed on prime sizes.

Issues such as DH keypair I think were fixed in later versions of 7, so it may be worth setting up a test environment with same setup and same java version to replicate than upgrading java version to at least 8x to see if it helps.

Matt

On Tue, Nov 7, 2017 at 4:21 PM, Grant Jackson <grant...@gmail.com> wrote:

Hi Christopher,

Did you ever resolve this issue? It appears that we have a similar (but not identical) SSL error affecting the ReDBox connection to the ANDS DataCite service.


2017-11-07 14:08:12,874          ERROR  namicPageServiceImpl Error during HTTP request:
javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair


Ours has previously been working fine, but I suspect we have not minted a DOI since your post. Thank you.

Cheers, Grant

[matt]

Hi Grant, Chris

 

I'm not sure if related, but I have seen issues like this before, with SSL handshakes  when using an older version of java, where there were limits were placed on prime sizes.

Issues such as DH keypair I think were fixed in later versions of 7, so it may be worth setting up a test environment with same setup and same java version to replicate than upgrading java version to at least 8x to see if it helps.

 

Matt

[Andrew Brazzatti]

Hi Grant,

As Matt has suggested, a JVM upgrade should work for you but if you haven't yet upgraded to the 1.9 release then you may need to go with the latest Java 7 release as there are issues with the library that renders the pages when running with Java 8 before the 1.9 release of ReDBox.

Thanks,
Andrew

[Grant Jackson]

Excellent, thanks Matt and Andrew.

I confirm we are using a rather old version of Java and still running ReDBox 1.6.1 in production (but a newer version in our test environment). Do you know if ReDBox 1.6.1 will run ok under Java 7?

Thank you.

Cheers, Grant

[Andrew Brazzatti]

Hi Grant,

That's correct. ReDBox 1.6.1 will run fine under Java 7 (either the Oracle or OpenJDK versions).

Thanks,
Andrew

On Thu, Nov 9, 2017 at 9:40 AM, Grant Jackson <grant...@gmail.com> wrote:

Excellent, thanks Matt and Andrew.

I confirm we are using a rather old version of Java and still running ReDBox 1.6.1 in production (but a newer version in our test environment). Do you know if ReDBox 1.6.1 will run ok under Java 7?

Thank you.

Cheers, Grant

[Christopher McAvaney]

G'day Grant,

Yes, as the thread has discussed.  It was a Java version issue as the CA information has changed over time.
An upgrade to the JVM solved the issue.

Regards,
Christopher

[Grant Jackson]

Great, thanks for the version info Andrew.

Thanks for the confirmation Christopher.

Cheers, Grant

On Thu, Nov 9, 2017 at 10:07 AM, Andrew Brazzatti <and...@redboxresearchdata.com.au> wrote:

Hi Grant,

That's correct. ReDBox 1.6.1 will run fine under Java 7 (either the Oracle or OpenJDK versions).

Thanks,
Andrew

On Thu, Nov 9, 2017 at 9:40 AM, Grant Jackson <grant...@gmail.com> wrote:

Excellent, thanks Matt and Andrew.

I confirm we are using a rather old version of Java and still running ReDBox 1.6.1 in production (but a newer version in our test environment). Do you know if ReDBox 1.6.1 will run ok under Java 7?

Thank you.

Cheers, Grant

[Grant Jackson]

For the record:

- We are running ReDBox v1.6.1

- The SSL error occurred when running under Java 1.6.0_30

- The SSL error was fixed when running under Java 1.7.0_79

Thanks Andrew, Matt and Christopher for your advice.

Cheers, Grant

On Thu, Nov 9, 2017 at 11:23 AM, Grant Jackson <grant...@gmail.com> wrote:

Great, thanks for the version info Andrew.

Thanks for the confirmation Christopher.

Cheers, Grant