Return-Path: 
 <common-issues-return-53598-apmail-hadoop-common-issues-archive=hadoop.apache.org@hadoop.apache.org>
X-Original-To: apmail-hadoop-common-issues-archive@minotaur.apache.org
Delivered-To: apmail-hadoop-common-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id C1899101BA
	for <apmail-hadoop-common-issues-archive@minotaur.apache.org>;
 Mon, 23 Sep 2013 17:59:35 +0000 (UTC)
Received: (qmail 21440 invoked by uid 500); 23 Sep 2013 17:59:19 -0000
Delivered-To: apmail-hadoop-common-issues-archive@hadoop.apache.org
Received: (qmail 21322 invoked by uid 500); 23 Sep 2013 17:59:17 -0000
Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:common-issues-help@hadoop.apache.org>
List-Unsubscribe: <mailto:common-issues-unsubscribe@hadoop.apache.org>
List-Post: <mailto:common-issues@hadoop.apache.org>
List-Id: <common-issues.hadoop.apache.org>
Reply-To: common-issues@hadoop.apache.org
Delivered-To: mailing list common-issues@hadoop.apache.org
Received: (qmail 21017 invoked by uid 99); 23 Sep 2013 17:59:09 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 23 Sep 2013 17:59:09 +0000
Date: Mon, 23 Sep 2013 17:59:09 +0000 (UTC)
From: "Chris Nauroth (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12669140.1379455914793.4061.1379959149003@arcas>
In-Reply-To: <JIRA.12669140.1379455914793@arcas>
References: <JIRA.12669140.1379455914793@arcas>
Subject: [jira] [Updated] (HADOOP-9977) Hadoop services won't start with
 different keypass and keystorepass when https is enabled
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


     [ https://issues.apache.org/jira/browse/HADOOP-9977?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chris Nauroth updated HADOOP-9977:
----------------------------------

       Resolution: Fixed
    Fix Version/s: 2.1.1-beta
                   3.0.0
           Status: Resolved  (was: Patch Available)

I've committed this to trunk, branch-2, and branch-2.1-beta.  Nicholas, thank you for the review.
                
> Hadoop services won't start with different keypass and keystorepass when https is enabled
> -----------------------------------------------------------------------------------------
>
>                 Key: HADOOP-9977
>                 URL: https://issues.apache.org/jira/browse/HADOOP-9977
>             Project: Hadoop Common
>          Issue Type: Bug
>          Components: security
>    Affects Versions: 2.1.0-beta
>            Reporter: Yesha Vora
>            Assignee: Chris Nauroth
>             Fix For: 3.0.0, 2.1.1-beta
>
>         Attachments: HADOOP-9977.1.patch
>
>
> Enable ssl in the configuration. While creating keystore, give different keypass and keystore password. (here, keypass = hadoop and storepass=hadoopKey)
> keytool -genkey -alias host1 -keyalg RSA -keysize 1024 -dname "CN=host1,OU=cm,O=cm,L=san jose,ST=ca,C=us" -keypass hadoop -keystore keystore.jks -storepass hadoopKey
> In , ssl-server.xml set below two properties.
> <property><name>ssl.server.keystore.keypassword</name><value>hadoop</value></property>
> <property><name>ssl.server.keystore.password</name><value>hadoopKey</value></property>
> Namenode, ResourceManager, Datanode, Nodemanager, SecondaryNamenode fails to start with below error.
> 2013-09-17 21:39:00,794 FATAL namenode.NameNode (NameNode.java:main(1325)) - Exception in namenode join
> java.io.IOException: java.security.UnrecoverableKeyException: Cannot recover key
>         at org.apache.hadoop.http.HttpServer.<init>(HttpServer.java:222)
>         at org.apache.hadoop.http.HttpServer.<init>(HttpServer.java:174)
>         at org.apache.hadoop.hdfs.server.namenode.NameNodeHttpServer$1.<init>(NameNodeHttpServer.java:76)
>         at org.apache.hadoop.hdfs.server.namenode.NameNodeHttpServer.start(NameNodeHttpServer.java:74)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.startHttpServer(NameNode.java:626)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.initialize(NameNode.java:488)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.<init>(NameNode.java:684)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.<init>(NameNode.java:669)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.createNameNode(NameNode.java:1254)
>         at org.apache.hadoop.hdfs.server.namenode.NameNode.main(NameNode.java:1320)
> Caused by: java.security.UnrecoverableKeyException: Cannot recover key
>         at sun.security.provider.KeyProtector.recover(KeyProtector.java:328)
>         at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:138)
>         at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:55)
>         at java.security.KeyStore.getKey(KeyStore.java:792)
>         at sun.security.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:131)
>         at sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:68)
>         at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:259)
>         at org.apache.hadoop.security.ssl.FileBasedKeyStoresFactory.init(FileBasedKeyStoresFactory.java:170)
>         at org.apache.hadoop.security.ssl.SSLFactory.init(SSLFactory.java:121)
>         at org.apache.hadoop.http.HttpServer.<init>(HttpServer.java:220)
>         ... 9 more

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira