Return
-
Title
Can't log in to Foglight console using https. -
Description
Cannot access the Foglight console using https (8443).The following message is reported in Internet Explorer (IE):This page can't be displayedSSL_ERROR_NO_CYPHER_OVERLAP"The following messages are reported in Chrome:The webpage is not availableERR_SSL_VERSION_OR_CIPHER_MISMATCHA secure connection cannot be established because this site uses an upsupported protocol.TLS 1.0, 1.1, and 1.2 are selected under the Advanced tab of the IE Internet options.Setting “Use SSL 3.0” under the Advanced tab of the IE Internet options did not help. -
Cause
Cause 1:
The key on the FMS was using a DHE-DSS-AES256-SHA cipher. The key on another FMS at the site that was not showing the same problem was using a AES256-SHA cipher.
Cause 2:
The key file is missing in the key store
-
Resolution
Resolution 1:
A self-signed certificate is being used.
The output of the "openssl s_client -connect hostname:8443 -debug -showcerts" command indicates that the protocol used by the self-signed certificate is TLSv1 and the cipher is DHE-DSS-AES256-SHANew, TLSv1/SSLv3, Cipher is DHE-DSS-AES256-SHASSL-Session:Protocol : TLSv1Cipher : DHE-DSS-AES256-SHARegenerate the self-signed certificate on the FMS using RSA encryption.- Backup the tomcat keystore:
Navigate to the following directory:
$FMS_HOME/config
Issue the following command:
cp -p tomcat.keystore tomcat.bak - Delete the current key:
Navigate to the following directory:
$FMS_HOME/jre/bin
Issue the following command:
./keytool -keystore $FMS_HOME/config/tomcat.keystore -storepass nitrogen -alias tomcat -delete - Generate a new key using RSA encryption that is valid for 1 year:
Issue the following command:
./keytool -keystore $FMS_HOME/config/tomcat.keystore -storepass nitrogen -alias tomcat -keyalg RSA -keysize 2048 -genkeypair -validity 365 - Stop and start the FMS.
Resolution 2:
The key file is missing in the keystore, only the certificate is available.
-
Please run the below command to list all keys and certificates in the tomcat.keystore:$FMS_HOME/jre/bin/keytool -keystore $FMS_HOME/config/tomcat.keystore -list -v > MyKeysList.txt
- Now review the output file MyKeysList.txt and make sure there are 2 entries with the following entry type parameter:
Entry type: PrivateKeyEntry
Entry type: trustedCertEntry - If the privateKeyEntry is missing please generate a new key, signed it again and import the certificate afterwards. Use this command to generate the key:
$FMS_HOME/jre/bin/keytool -keystore $FMS_HOME/config/tomcat.keystore -storepass nitrogen -alias tomcat -keyalg RSA -keysize 2048 -genkeypair -validity 365 -ext SAN=dns:servername.domain.com
Solution 238711 provides the detailed steps to import a 3 party certificate.
- Backup the tomcat keystore: