Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id 0F4D7200C91 for ; Sun, 11 Jun 2017 16:05:43 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id 0B054160BCF; Sun, 11 Jun 2017 14:05:43 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 0133D160BC5 for ; Sun, 11 Jun 2017 16:05:41 +0200 (CEST) Received: (qmail 99691 invoked by uid 500); 11 Jun 2017 14:05:40 -0000 Mailing-List: contact user-help@flink.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Delivered-To: mailing list user@flink.apache.org Received: (qmail 99681 invoked by uid 99); 11 Jun 2017 14:05:40 -0000 Received: from mail-relay.apache.org (HELO mail-relay.apache.org) (140.211.11.15) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 11 Jun 2017 14:05:40 +0000 Received: from Tzu-Lis-MBP.fritz.box.mail (dslb-084-059-068-070.084.059.pools.vodafone-ip.de [84.59.68.70]) by mail-relay.apache.org (ASF Mail Server at mail-relay.apache.org) with ESMTPSA id 23CEE1A00A8; Sun, 11 Jun 2017 14:05:38 +0000 (UTC) Date: Sun, 11 Jun 2017 16:05:35 +0200 From: "Tzu-Li (Gordon) Tai" To: vinay patil , user@flink.apache.org Message-ID: In-Reply-To: References: <1496406135048-13455.post@n4.nabble.com> <1496673141950-13489.post@n4.nabble.com> <1496675583562-13490.post@n4.nabble.com> Subject: Re: In-transit Data Encryption in EMR X-Mailer: Airmail (420) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="593d4e2f_5f5c06a1_110" archived-at: Sun, 11 Jun 2017 14:05:43 -0000 --593d4e2f_5f5c06a1_110 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hi Vinay, Apologies for the inactivity on this thread, I was occupied with some cri= tical fixes for 1.3.1. 1. Can anyone please explain me how do you test if SSL is working correct= ly =3F Currently I am just relying on the logs. A=46AIK, if any of the SSL configuration settings are enabled (*.ssl.enab= led) and your job is running fine, then everything should be functioning.= 2. Wild Card is not working with the keytool command, can you please let = me know what is the issue with the following command: The wildcard option only works for wildcarding subdomains. =46or example, SAN=3D*.domain.com On 9 June 2017 at 4:33:46 PM, vinay patil (vinay18.patil=40gmail.com) wro= te: Hi Guys, Can anyone please provide me solution to my queries. On Jun 8, 2017 11:30 PM, =22Vinay Patil=22 <=5Bhidden email=5D> wrote: Hi Guys, I am able to setup SSL correctly, however the following command =C2=A0doe= s not work correctly and results in the error I had mailed earlier flink run -m yarn-cluster -yt deploy-keys/ TestJob.jar =46ew Doubts:=C2=A0 1. Can anyone please explain me how do you test if SSL is working correct= ly =3F Currently I am just relying on the logs. 2. Wild Card is not working with the keytool command, can you please let = me know what is the issue with the following command: keytool -genkeypair -alias ca -keystore: -ext SAN=3Ddns:node1.*=C2=A0 Regards, Vinay Patil On Mon, Jun 5, 2017 at 8:43 PM, vinay patil =5Bvia Apache =46link User Ma= iling List archive.=5D <=5Bhidden email=5D> wrote: Hi Gordon, The yarn session gets created when I try to run the following command: yarn-session.sh -n 4 -s 2 -jm 1024 -tm 3000 -d --ship deploy-keys/ However when I try to access the Job Manager UI, it gives me exception as= : javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorExce= ption: PKIX path building failed: sun.security.provider.certpath.SunCertP= athBuilderException: unable to find valid certification path to requested= target I am able to see the Job Manager UI =C2=A0when I imported the CA certific= ate to java truststore on EMR master node : keytool -keystore /etc/alternatives/jre/lib/security/cacerts -importcert = -alias =46LINKSSL -file ca.cer Does this mean that SSL is configured correctly =3F I can see in the Job = Manager configurations and also in th e logs. Is there any other way to v= erify =3F Also the keystore and truststore =C2=A0password should be masked in the l= ogs which is not case. 2017-06-05 14:51:31,135 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.enabled, true 2017-06-05 14:51:31,136 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.keystore, deploy-keys/ca.keystore 2017-06-05 14:51:31,136 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.keystore-password, password 2017-06-05 14:51:31,136 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.key-password, password 2017-06-05 14:51:31,136 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.truststore, deploy-keys/ca.truststore 2017-06-05 14:51:31,136 IN=46O =C2=A0org.apache.flink.configuration.Globa= lConfiguration =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Loading configu= ration property: security.ssl.truststore-password, password Regards, Vinay Patil If you reply to this email, your message will be added to the discussion = below: http://apache-flink-user-mailing-list-archive.2336050.n4.nabble.com/In-tr= ansit-Data-Encryption-in-EMR-tp13455p13490.html To start a new topic under Apache =46link User Mailing List archive., ema= il =5Bhidden email=5D To unsubscribe from Apache =46link User Mailing List archive., click here= . NAML View this message in context: Re: In-transit Data Encryption in EMR Sent from the Apache =46link User Mailing List archive. mailing list arch= ive at Nabble.com. --593d4e2f_5f5c06a1_110 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline