Export is idle with the event_log error messages “Cannot establish secure connection” and “The network security password on the target does not match that on the source” (4296837)

In a SharePlex instance with SSL security enabled, the Export is idle with the event_log error messages as follows:

sp_ctrl (alvsupl14:9138)> status

Brief Status for alvsupl14

Process          State                             PID     Running   Since

---------------  ------------------------------  --------  --------------------

Cop              Running                            32103  18-Sep-18 15:18:23

Cmd & Ctrl       Running                              477  18-Sep-18 16:06:10

Capture          Running                              516  18-Sep-18 16:07:09

Read             Running                              540  18-Sep-18 16:07:10

Export           Idle

sp_ctrl (alvsupl14:9138)> show log reverse

Info     2018-09-18 16:07:23.910996 32103 292450880 Export exited with code=1, pid = 584  (exporting to alvsupl17 queue alvsupl14)

Warning  2018-09-18 16:07:23.909828 584 3747097216 Export cannot connect to import on alvsupl17: [SP-XPT01002] Cannot establish secure connection.  <CAUSE> The network security password on the target does not match that on the source.  <ADVICE> Run 'sp_security --setup' on source and target, setting the same network password.  See 'http://advice.shareplex.com/SP-XPT01002' for additional advice and support.

Info     2018-09-18 16:07:23.907331 584 3747097216 Export connected to host on alvsupl17

Info     2018-09-18 16:07:23.792992 584 292450880 Export launched, pid = 584  (exporting to alvsupl17 queue alvsupl14)

Info     2018-09-18 16:07:13.791699 32103 292450880 Export exited with code=1, pid = 581  (exporting to alvsupl17 queue alvsupl14)

Warning  2018-09-18 16:07:13.790418 581 4183902848 Export cannot connect to import on alvsupl17: [SP-XPT01002] Cannot establish secure connection.  <CAUSE> The network security password on the target does not match that on the source.  <ADVICE> Run 'sp_security --setup' on source and target, setting the same network password.  See 'http://advice.shareplex.com/SP-XPT01002' for additional advice and support.

The corresponding entries on the target event_log are:

Notice   2018-09-18 16:05:11.698203 12136 3599062880 Cop: Bad password  [module cop]

Notice   2018-09-18 16:10:11.873322 12136 3599062880 Cop: Bad password  [module cop]

For whatever reasons, the SSL network password differs across source and target. Some plausible scenarios can be:

The source and target installation were completed and SSL enabled on them using different password whereas it is required that the same password be used on source and target.

The password on one of the source or target was changed (after both were first installed with the same password) but the change was never implemented on the corresponding source/target in question.

To fix the problem, carry out the following steps on the target and change its password to match with that of the source:

1. Shutdown the target

sp_ctrl (alvsupl17:9138)> shutdown

1. While in /proddir/bin directory, issue “sp_security –setup” at the OS prompt and change the SSL password to match with that of the source as the following example shows:

[ORA11GR2@alvsupl17]/home/paul/p91338-11g/prod/bin> ./sp_security --setup

Security Setup Wizard

---------------------

This wizard will walk you through setting up the SharePlex network security.

Setup configuration for '/home/paul/p91338-11g/var' and Port 9138 [N]: y

Choose your network security model.  Please note the following:

         * Cop must be down when the security model is changed, or when the network password is changed

         * The same model must be used among all SharePlex nodes replicating to each other

         * For security model [1], the same network password must be set on all SharePlex nodes replicating to each other

  [1] Use basic SSL/TLS connections

  [2] Use non-SSL/TLS connections (default prior to SharePlex 9.1.3)

Security model [1]: 1

Please enter a network password that will be used for authentication

among the SharePlex nodes.  All SharePlex nodes that replicate data to each

other must have the same network password.

Network password [**********]:

Please re-enter the network password

Network password:

Security settings:

Configuration for '/home/paul/p91338-11g/var' and Port 9138:

  Security model            : SSL/TLS

  Network password          : stored for unattended startup

  SSL key file password     : stored for unattended startup

  SSL key file              : key.pem

  SSL cert file             : cert.pem

Setup complete!

[1] +  Done                    ./sp_cop -up91338 &

1. Then restart SharePlex on target and the Import on target and Export on source will not be idle anymore. It may be noted that Once the password was changed, the Export on source will take 2 minutes to handshake with Import on target or will need to be bounced to do I sooner than 2 minutes. The following illustrates this:

[ORA11GR2@alvsupl17]/home/paul/p91338-11g/prod/bin>  ./sp_cop -up91338 &

[1]     13776

[ORA11GR2@alvsupl17]/home/paul/p91338-11g/prod/bin>

*******************************************************

* SharePlex for Oracle Startup

* Copyright 2018 Quest Software Inc.

* ALL RIGHTS RESERVED.

* Protected by U.S. Patents: 7,461,103 and 7,065,538

* Version: 9.1.3.38-m64-oracle110

* VarDir : /home/paul/p91338-11g/var

* Port   : 9138

*******************************************************

[ORA11GR2@alvsupl17]/home/paul/p91338-11g/prod/bin> ./sp_ctrl

*******************************************************

* SharePlex for Oracle Command Utility

* Copyright 2018 Quest Software Inc.

* ALL RIGHTS RESERVED.

* Protected by U.S. Patents: 7,461,103 and 7,065,538

*******************************************************

sp_ctrl (alvsupl17:9138)> status

Brief Status for alvsupl17

Process          State                             PID     Running   Since

---------------  ------------------------------  --------  --------------------

Cop              Running                            13776  18-Sep-18 16:13:58

Cmd & Ctrl       Running                            13780  18-Sep-18 16:14:16

Import           Running                            13797  18-Sep-18 16:14:41

Post             Running                            13798  18-Sep-18 16:14:41

There are no active configuration files

sp_ctrl (alvsupl17:9138)>

If the password discrepancy exists on all SharePlex instances downstream, carry out similar steps on them.

If in doubt about the value of SSL password on source, change the password on source and target so that the passwords match. Changing the passwords will in no way jeopardize the ongoing replication so this step can be performed if needed.