ERR: An unexpected SSLHandshake

[Satwika sree]

Hello everyone,

I'm currently in the process of setting up a Wazuh cluster with a single node. To achieve this, I've generated SSL certificates on node1. However, when attempting to use these SSL certificates for node2, I encountered the following error:

**ERR**: An unexpected `SSLHandshakeException` occurred: `PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors.`

Could someone kindly assist me in resolving this issue? 

Thank you for your help.

[Olusegun Adenrele Oyebo]

Hello Satwika,

Thank you for using Wazuh,

What steps did you follow in trying to deploy the certificates on the node? Kindly confirm if you following the steps outlined in Certificates creation in generating the certificates.

Also please confirm you also used this as guide during the deployment of the certificate Deploying certificates.  You can also check the link for more information on certificate deployment.

I hope this was helpful. Do not hesitate to contact us further if issue persists or you have any other query.

Best Regards.

[Satwika sree]

Hi,

Yes, I used the guide available at https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/step-by-step.html#deploying-certificates as a reference while deploying the certificates.

[Olusegun Adenrele Oyebo]

Hello  Satwika,

Sorry for the late response.

From your error it seems your nodes have different CAs.

I'd like to ask additional questions with regards to the error you're facing:

• Were you initially running a single node architecture which you want to convert to a cluster or it's a new installation?
• At what point did you encounter the error? Was it at the point of cluster initialization? If it's at the point of cluster initialization, please revert with the wazuh-cluster.log file located in the directory /var/log/wazuh-indexer/wazuh-cluster.log for further review.

We will be expecting your feedback so as to assist you further.

Best Regards.

[Satwika sree]

Hi,

It's a new installation, and when I'm attempting the cluster initialization process after Wazuh indexer installation and configuration, I'm encountering an error when running this command: 

# /usr/share/wazuh-indexer/bin/indexer-security-init.sh.

root@soc3-ThinkCentre-M72e:/home/soc3# /usr/share/wazuh-indexer/bin/indexer-security-init.sh  

**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755           **
**************************************************************************
Security Admin v7
Will connect to 192.168.20.159:9200 ... done
Connected as "CN=admin,OU=Wazuh,O=Wazuh,L=California,C=US"
OpenSearch Version: 2.6.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Cannot retrieve cluster state due to: 30,000 milliseconds timeout on connection http-outgoing-2 [ACTIVE]. This is not an error, will keep on trying ...
  Root cause: java.net.SocketTimeoutException: 30,000 milliseconds timeout on connection http-outgoing-2 [ACTIVE] (java.net.SocketTimeoutException/java.net.SocketTimeoutException)
   * Try running securityadmin.sh with -icl (but no -cl) and -nhnv (If that works you need to check your clustername as well as hostnames in your TLS certificates)
   * Make sure that your keystore or PEM certificate is a client certificate (not a node certificate) and configured properly in opensearch.yml
   * If this is not working, try running securityadmin.sh with --diagnose and see diagnose trace log file)
   * Add --accept-red-cluster to allow securityadmin to operate on a red cluster.
Cannot retrieve cluster state due to: 30,000 milliseconds timeout on connection http-outgoing-3 [ACTIVE]. This is not an error, will keep on trying ...
  Root cause: java.net.SocketTimeoutException: 30,000 milliseconds timeout on connection http-outgoing-3 [ACTIVE] (java.net.SocketTimeoutException/java.net.SocketTimeoutException)
   * Try running securityadmin.sh with -icl (but no -cl) and -nhnv (If that works you need to check your clustername as well as hostnames in your TLS certificates)
   * Make sure that your keystore or PEM certificate is a client certificate (not a node certificate) and configured properly in opensearch.yml

When I check the Wazuh indexer logs,

 

[2023-09-04T12:47:27,643][WARN ][o.o.c.c.ClusterFormationFailureHelper] [node-1] cluster-manager not discovered or elected yet, an election requires a node with id [tUQv5ImwSTy4ofT-eZY72g], have discovered [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] which is not a quorum; discovery will continue using [192.168.20.158:9300] from hosts providers and [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] from last-known cluster state; node term 2, last-accepted version 89 in term 2
[2023-09-04T12:47:37,644][WARN ][o.o.c.c.ClusterFormationFailureHelper] [node-1] cluster-manager not discovered or elected yet, an election requires a node with id [tUQv5ImwSTy4ofT-eZY72g], have discovered [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] which is not a quorum; discovery will continue using [192.168.20.158:9300] from hosts providers and [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] from last-known cluster state; node term 2, last-accepted version 89 in term 2
[2023-09-04T12:47:39,018][ERROR][o.o.s.c.ConfigurationLoaderSecurity7] [node-1] Exception while retrieving configuration for [INTERNALUSERS, ACTIONGROUPS, CONFIG, ROLES, ROLESMAPPING, TENANTS, NODESDN, WHITELIST, ALLOWLIST, AUDIT] (index=.opendistro_security)
org.opensearch.cluster.block.ClusterBlockException: blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];
        at org.opensearch.cluster.block.ClusterBlocks.globalBlockedException(ClusterBlocks.java:205) ~[opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.cluster.block.ClusterBlocks.globalBlockedRaiseException(ClusterBlocks.java:191) ~[opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.action.get.TransportMultiGetAction.doExecute(TransportMultiGetAction.java:81) ~[opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.action.get.TransportMultiGetAction.doExecute(TransportMultiGetAction.java:58) ~[opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:218) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.indexmanagement.rollup.actionfilter.FieldCapsFilter.apply(FieldCapsFilter.kt:118) [opensearch-index-management-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:216) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.performanceanalyzer.action.PerformanceAnalyzerActionFilter.apply(PerformanceAnalyzerActionFilter.java:78) [opensearch-performance-analyzer-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:216) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.security.filter.SecurityFilter.apply0(SecurityFilter.java:232) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.filter.SecurityFilter.apply(SecurityFilter.java:149) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:216) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.action.support.TransportAction.execute(TransportAction.java:188) [opensearch-2.6.0.jar:2.6.0]        at org.opensearch.action.support.TransportAction.execute(TransportAction.java:107) [opensearch-2.6.0.jar:2.6.0]        at org.opensearch.client.node.NodeClient.executeLocally(NodeClient.java:110) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.client.node.NodeClient.doExecute(NodeClient.java:97) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.client.support.AbstractClient.execute(AbstractClient.java:465) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.client.support.AbstractClient.multiGet(AbstractClient.java:581) [opensearch-2.6.0.jar:2.6.0]
        at org.opensearch.security.configuration.ConfigurationLoaderSecurity7.loadAsync(ConfigurationLoaderSecurity7.java:208) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.configuration.ConfigurationLoaderSecurity7.load(ConfigurationLoaderSecurity7.java:99) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.configuration.ConfigurationRepository.getConfigurationsFromIndex(ConfigurationRepository.java:372) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.configuration.ConfigurationRepository.reloadConfiguration0(ConfigurationRepository.java:318) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.configuration.ConfigurationRepository.reloadConfiguration(ConfigurationRepository.java:303) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at org.opensearch.security.configuration.ConfigurationRepository$1.run(ConfigurationRepository.java:163) [opensearch-security-2.6.0.0.jar:2.6.0.0]
        at java.lang.Thread.run(Thread.java:833) [?:?]
[2023-09-04T12:47:47,644][WARN ][o.o.c.c.ClusterFormationFailureHelper] [node-1] cluster-manager not discovered or elected yet, an election requires a node with id [tUQv5ImwSTy4ofT-eZY72g], have discovered [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] which is not a quorum; discovery will continue using [192.168.20.158:9300] from hosts providers and [{node-1}{vIyQ96FMTwWNMPNSs38xnA}{XtYjMDJpRxif3WtMumBoaA}{192.168.20.159}{192.168.20.159:9300}{dimr}{shard_indexing_pressure_enabled=true}] from last-known cluster state; node term 2, last-accepted version 89 in term 2

Kindly help to resolve this issue.

[Olusegun Adenrele Oyebo]

Hello Satwika,

Thanks for your feedback and logs.

Errors like this could be due to when the ports for the wazuh indexer communication is closed. Can you confirm that the required ports are opened on both nodes (9200,9300-9400). If the ports are not open, you can run the below commands to open the ports for example 9200:

• firewall-cmd --permanent --zone=public --add-port=9200/tcp
• firewall-cmd --reload
• systemctl restart firewalld.service

After enabling the ports, you can then try and initialize the cluster again. You can also go through the link for other port requirements.

I hope this helps. Do not hesitate to get back to us on the outcome or if you have any other query and we will be glad to render assistance.

Best regards.

--
You received this message because you are subscribed to the Google Groups "Wazuh | Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/0a27cf96-5ff2-453e-a865-86e7379e7dc0n%40googlegroups.com.

[Satwika sree]

Hi,

I had tried what u send in pervious but it's not resolved the issue.

[Olusegun Adenrele Oyebo]

Hello Satwika,

Thanks for your feedback.

What we need to confirm now is your config files. Can you check your /etc/wazuh-indexer/opensearch.yml and confirm that the paths specified are the right directories where your certificates are located. Example of the content of the YAML file should include the below contents:

plugins.security.ssl.http.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.http.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem
plugins.security.ssl.transport.pemcert_filepath: /etc/wazuh-indexer/certs/indexer.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/wazuh-indexer/certs/indexer-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/wazuh-indexer/certs/root-ca.pem

Validate that does certificates are by default in those paths or if any changes were made, kindly replace the default paths. You can also share your config file for further review and also the content of the certificate directory by running the command: ls -al /etc/wazuh-indexer/certs/

Will be expecting your feedback so as to assist you accordingly

Best regards.

[Olusegun Adenrele Oyebo]

Hello  Satwika,

I trust you're doing fine.

Checking up on this query to know if you'll still need further assistance. Do not hesitate to reach out to us in case you need anything.

Best regards.

[Satwika sree]

Hi,

Thank you for your assistance. 

I have successfully set up the Wazuh cluster following the Wazuh installation assistant (https://documentation.wazuh.com/current/installation-guide/wazuh-indexer/installation-assistant.html).