Jira (PDB-4729) puppetdb connection rejected due to dh public key

6 views
Skip to first unread message

Blue Umbrella (Jira)

unread,
May 11, 2020, 2:15:03 AM5/11/20
to puppe...@googlegroups.com
Blue Umbrella created an issue
 
PuppetDB / Bug PDB-4729
puppetdb connection rejected due to dh public key
Issue Type: Bug Bug
Affects Versions: PDB 6.10.1
Assignee: Unassigned
Components: PuppetDB
Created: 2020/05/10 11:14 PM
Priority: High High
Reporter: Blue Umbrella

JRE:

java-1.8.0-openjdk-headless-1.8.0.252.b09-2.el8_1.x86_64

 

From the puppetdb.log file:

 

2020-05-11T15:59:56.901+10:00 WARN [qtp1040429609-35] [c.p.h.c.i.PersistentSyncHttpClient] Error executing http request
javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1566)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:545)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:819)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:783)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:626)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:271)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:316)
at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:503)
at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:120)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:588)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: DHPublicKey does not comply to algorithm constraints
at sun.security.ssl.DHCrypt.checkConstraints(DHCrypt.java:237)
at sun.security.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:817)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:290)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1082)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:1015)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:1012)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1504)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:281)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:339)
... 9 common frames omitted
2020-05-11T15:59:56.905+10:00 WARN [qtp1040429609-35] [puppetserver] Puppet Error connecting to puppetdb on 8081 at route /pdb/cmd/v1?checksum=2b4150537a39ceb3d0acb32c5ac7cbfb7997810f&version=5&certname=unix.host&command=replace_facts&producer-timestamp=2020-05-11T05:59:55.889Z, error message received was 'Error executing http request'. Failing over to the next PuppetDB server_url in the 'server_urls' list
2020-05-11T15:59:56.907+10:00 ERROR [qtp1040429609-35] [puppetserver] Puppet Failed to execute '/pdb/cmd/v1?checksum=2b4150537a39ceb3d0acb32c5ac7cbfb7997810f&version=5&certname=unix.host&command=replace_facts&producer-timestamp=2020-05-11T05:59:55.889Z' on at least 1 of the following 'server_urls': https://puppetdb:8081
2020-05-11T15:59:56.909+10:00 ERROR [qtp1040429609-35] [puppetserver] Puppet /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb/http.rb:115:in `raise_request_error' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb/http.rb:160:in `failover_action' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb/http.rb:247:in `action' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb/command.rb:64:in `block in submit' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb.rb:99:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb/command.rb:63:in `submit' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb.rb:62:in `block in submit_command' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb.rb:99:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb.rb:59:in `submit_command' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/facts/puppetdb.rb:52:in `block in save' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/puppetdb.rb:99:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/facts/puppetdb.rb:20:in `save' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/store_configs.rb:24:in `save' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:293:in `save' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/node/facts.rb:21:in `save' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:40:in `save_facts_from_request' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/catalog/compiler.rb:49:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/indirector/indirection.rb:197:in `find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:127:in `do_find' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:54:in `block in call' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/context.rb:62:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet.rb:274:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/api/indirected_routes.rb:53:in `call' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:82:in `block in process' org/jruby/RubyArray.java:1800:in `each' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:81:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:88:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/route.rb:88:in `process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:87:in `block in process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:70:in `block in with_request_profiling' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler/around_profiler.rb:58:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/util/profiler.rb:51:in `profile' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:66:in `with_request_profiling' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:86:in `block in process' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:93:in `respond_to_errors' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/network/http/handler.rb:85:in `process' uri:classloader:/puppetserver-lib/puppet/server/master.rb:64:in `block in handleRequest' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet/context.rb:62:in `override' /opt/puppetlabs/puppet/lib/ruby/vendor_ruby/puppet.rb:274:in `override' uri:classloader:/puppetserver-lib/puppet/server/master.rb:63:in `handleRequest'
2020-05-11T15:59:56.912+10:00 ERROR [qtp1040429609-35] [puppetserver] Puppet Server Error: Failed to execute '/pdb/cmd/v1?checksum=2b4150537a39ceb3d0acb32c5ac7cbfb7997810f&version=5&certname=unix.host&command=replace_facts&producer-timestamp=2020-05-11T05:59:55.889Z' on at least 1 of the following 'server_urls': https://puppetdb:8081

Add Comment Add Comment
 
This message was sent by Atlassian Jira (v8.5.2#805002-sha1:a66f935)
Atlassian logo

Austin Blatt (Jira)

unread,
Jun 2, 2020, 2:24:04 PM6/2/20
to puppe...@googlegroups.com
Austin Blatt commented on Bug PDB-4729
 
Re: puppetdb connection rejected due to dh public key

I believe this an issue with Java 8, upgrading to Java 11 should solve the issue. Also adding the following java arg should work as well -Djdk.tls.ephemeralDHKeySize=2048

Reply all
Reply to author
Forward
0 new messages