Can't acces to the iDempiere monitor page

[Nicolas Micoud]

Hi,

I'm currently migrating our 2.1 to the latest 4.1 version and i can't connect to the iDempiere monitor page.
ATM, the server is executed by Eclipse and the url i'm using is : https://localhost:8443/idempiereMonitor (nothing special here)

Firefox display a message (something like Connection is not secure : Failure)




Log says :

avr. 04, 2017 1:35:09 PM org.eclipse.jetty.util.thread.QueuedThreadPool$2 run
AVERTISSEMENT:
java.lang.NoSuchMethodError: sun.security.ssl.SupportedEllipticCurvesExtension.getPreferredCurve(Ljava/security/AlgorithmConstraints;)I
    at sun.security.ssl.ServerHandshaker.setupEphemeralECDHKeys(ServerHandshaker.java:1477)
    at sun.security.ssl.ServerHandshaker.trySetCipherSuite(ServerHandshaker.java:1282)
    at sun.security.ssl.ServerHandshaker.chooseCipherSuite(ServerHandshaker.java:1079)
    at sun.security.ssl.ServerHandshaker.clientHello(ServerHandshaker.java:745)
    at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:228)
    at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    at sun.security.ssl.Handshaker$1.run(Unknown Source)
    at sun.security.ssl.Handshaker$1.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
    at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:629)
    at org.eclipse.jetty.server.NegotiatingServerConnection.fill(NegotiatingServerConnection.java:153)
    at org.eclipse.jetty.server.NegotiatingServerConnection.onFillable(NegotiatingServerConnection.java:98)
    at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
    at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
    at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:201)
    at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:273)
    at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:95)
    at org.eclipse.jetty.io.SelectChannelEndPoint$2.run(SelectChannelEndPoint.java:93)
    at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.executeProduceConsume(ExecuteProduceConsume.java:303)
    at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:148)
    at org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:136)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:671)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:589)
    at java.lang.Thread.run(Unknown Source)

avr. 04, 2017 1:35:09 PM org.eclipse.jetty.util.thread.QueuedThreadPool$2 run
AVERTISSEMENT: Unexpected thread death: org.eclipse.jetty.util.thread.QueuedThreadPool$2@33b9041d in qtp579787973{STARTED,10<=12<=200,i=5,q=0}

Any hint ?

Thanks,

Nicolas

[Carlos Antonio Ruiz Gomez]

Hi Nicolas, it's related to ALPN that must be in sync with java version.

See:
https://idempiere.atlassian.net/browse/IDEMPIERE-3136?focusedCommentId=36103&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-36103
http://www.eclipse.org/jetty/documentation/current/alpn-chapter.html#alpn-versions

Regards,

Carlos Ruiz


El 04/04/17 a las 13:40, Nicolas Micoud escribió:

[Nicolas Micoud]

Hi Carlos,

Thanks for the links.
I know there is a solution, will look at it later

Regards,

Nicolas

[Joseph]

Hi, the same error for me.

Nicolas, do u solve this issue ?? 

My env is:

win7 64

java8  (jdk-8u131)

id4.1 (bin 20170427)

3.1 is good , but after upgrade to 4.1, monitor page is unavailabe. .

https://xx/idempiereMonitor issue "The client and server don't support a common SSL protocol version or cipher suite." under opera or "ERR_SSL_VERSION_OR_CIPHER_MISMATCH" under chrome .

Follow Carlos's guide (thanks to hieplq also)

1. download the jar from :

http://central.maven.org/maven2/org/mortbay/jetty/alpn/alpn-boot/8.1.11.v20170118/alpn-boot-8.1.11.v20170118.jar

2. rename it as alpn-boot.jar

3. replace the older file in idempiere root directory

4. restart server

5. https failure

What's my missing or wrong , thank for any suggestion.

Jospeh

[Joseph]

And I check the starup args , alpn-boot is here , i really dont know how to fix it , :-( .....

-- idempiere-server.bat---

FOR %%c in (plugins\org.eclipse.equinox.launcher_1.*.jar) DO set JARFILE=%%c

@"%JAVA%" 

-Dosgi.console=localhost:12612 

-Xbootclasspath/p:alpn-boot.jar  

-Dorg.osgi.framework.bootdelegation=sun.security.ssl,org.eclipse.jetty.alpn 

-Djetty.home=jettyhome 

-Djetty.etc.config.urls=etc/jetty.xml,etc/jetty-selector.xml,etc/jetty-ssl.xml,etc/jetty-https.xml,etc/jetty-deployer.xml 

-XX:MaxPermSize=192m 

-Dmail.mime.encodefilename=true 

-Dmail.mime.decodefilename=true 

-Dmail.mime.encodeparameters=true 

-Dmail.mime.decodeparameters=true 

-jar %JARFILE% -application org.adempiere.server.application

[Joseph]

After search and learn some info about it :

1. HTTP2 need ALPN ( negotiation protocol) or NPN ( chrome not)

2. ID's jetty version = 9.3.10.v20160621 only support ALPN ,

3. My jdk version = u131 , just out of the list in official jetty page, u131 is not compatible with alpn-boot-8.1.11.v20170118.jar ?

Anybody under u131 with the same problem or older version less than 131 is ok ?

Regards

Joseph

[Nicolas Micoud]

Hi Joseph,
Unfortunately, i did not try since my last answer (was in holidays last week).
I need to first finish the migration and then after i will have a look at the idempiere monitor access issue.
I can't help you for that, sorry

Regards,

Nicolas

[Joseph]

Hi , it's a mark of Issue fixed ！！

Version :         4.1.0.v20170505-0431

DB Version : 201705041136_IDEMPIERE-3338.sql

JVM :                 Java HotSpot(TM) 64-Bit Server VM 25.131-b11

OS :                 Windows 7 6.1 Service Pack 1

Host :                 127.0.0.1

Lastest daily server (4.1.0.v20170505-0431)not surpport ssl as missing ssl lauching VM_ARGUMENTS:

Default vm is :

-Djetty.home=jettyhome 

-Djetty.etc.config.urls=etc/jetty.xml,etc/jetty-selector.xml,etc/jetty-ssl.xml,etc/jetty-https.xml,etc/jetty-deployer.xml

issue console:

May 10, 2017 9:04:07 AM org.eclipse.jetty.server.AbstractConnector doStart

Info: Started ServerConnector@e288054{HTTP/1.1,[http/1.1]}{localhost:8089}

May 10, 2017 9:04:07 AM org.eclipse.jetty.server.AbstractConnector doStart

Info: Started ServerConnector@3afbff94{SSL,[ssl, http/1.1]}{localhost:8443}

Should be:

-Xbootclasspath/p:alpn-boot.jar  

-Dorg.osgi.framework.bootdelegation=sun.security.ssl,org.eclipse.jetty.alpn 

-Djetty.home=jettyhome 

-Djetty.etc.config.urls=etc/jetty.xml,etc/jetty-deployer.xml,etc/jetty-ssl.xml,etc/jetty-ssl-context.xml,etc/jetty-http.xml,etc/jetty-alpn.xml,etc/jetty-http2.xml,etc/jetty-https.xml

console output :

May 10, 2017 12:25:53 PM org.eclipse.jetty.server.AbstractConnector doStart

Info: Started ServerConnector@738fdb56{SSL,[ssl, alpn, h2, h2-17, h2-16, h2-15, h2-14, http/1.1]}{localhost:5443}

May 10, 2017 12:25:53 PM org.eclipse.jetty.server.AbstractConnector doStart

Info: Started ServerConnector@35ff325e{HTTP/1.1,[http/1.1, h2c, h2c-17, h2c-16, h2c-15, h2c-14]}{localhost:5080}

It's a hard tweak by me.

Link:

https://bitbucket.org/idempiere/idempiere/commits/b3f8585 

http://idempiere.atlassian.net/browse/IDEMPIERE-3136

And alpn-boot-8.1.11.v20170118.jar (default) works fine under jdk u131 from 2017-5-2 .

Thanks to Hiep lq 

Joseph

-- idempiere-server.bat---

FOR %%c in (plugins\org.eclipse.equinox.launcher_1.*.jar) DO set JARFILE=%%c

@"%JAVA%" 

-Dosgi.console=localhost:12612 

-Xbootclasspath/p:alpn-boot.jar  

-Dorg.osgi.framework.bootdelegation=sun.security.ssl,org.eclipse.jetty.alpn 

-Djetty.home=jettyhome 

-Djetty.etc.config.urls=etc/jetty.xml,etc/jetty-deployer.xml,etc/jetty-ssl.xml,etc/jetty-ssl-context.xml,etc/jetty-http.xml,etc/jetty-alpn.xml,etc/jetty-http2.xml,etc/jetty-https.xml

-XX:MaxPermSize=192m 

-Dmail.mime.encodefilename=true 

-Dmail.mime.decodefilename=true 

-Dmail.mime.encodeparameters=true 

-Dmail.mime.decodeparameters=true 

-jar %JARFILE% -application org.adempiere.server.application

[hideaki hagiwara]

Thanks Joseph. It was a great help for me.

:D

[Nicolas Micoud]

Hi,

It works also here.
I just had to install new jdk (1.8.0_131) - old was 1.8.0_112 - and update launcher in Eclipse !
No more errors when trying to contact https:// ...

Thanks to everyone,

Regards,

Nicolas

[Kelly Muhindi]

Hi All, 

Here's how it worked for me:

1. Checked for my java version being used `java -version` (Mine was 1.8.0_171)
2. Checked for the required version of alpn library for my java version (check from: http://www.eclipse.org/jetty/documentation/current/alpn-chapter.html#alpn-versions). For my java version the jar required was: 8.1.7.v20160121
3. Searched for the apn-boot jar file from maven central and downloaded above version
4. In eclipse, open `Run Configuration` for my Idempiere instance and in the arguments tab added a VM option: -Xbootclasspath/p:/<download-path>/alpn-boot-8.1.12.v20180117.jar
5. Applied changes and run server.

Full details here: http://www.eclipse.org/jetty/documentation/current/alpn-chapter.html

[iqbal muhammad]

Is there a way to apply it directly to a production server, instead in eclipse?

Thank you.