GNU/Linux, Virtualization, Open Source, Oracle Fusion Middleware, Knowledge Management, troubleshooting & performance tuning tips.

Monday, June 7, 2010

Smart Update Error on Linux

I recently hit a SSL Handshake error when trying to apply a WebLogic Portal patch using Smart Update.

Smart Update simply tells that "Cannot verify account status", however, obviously my account is valid.

Environment:
Linux 2.6.32 x86_64 (on x86 probably the same, if not plz let me know)
Sun Java6 JDK 1.6.0_20
Oracle JRockit Mission Control 4.0.0 x86_64
WebLogic Portal 10.3.2 Sunshine release on top of WebLogic Server 10.3.2.0

Checking the Error Message in the stdout, you'll see something like below:

root@lucid:/opt/Oracle/Middleware/utils/bsu# ./bsu.sh
javax.xml.rpc.ServiceException: Error processing WSDL document:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: algorithm check failed: MD2withRSA is disabled
at org.apache.axis.client.Service.initService(Service.java:250)
at org.apache.axis.client.Service.(Service.java:165)
at org.apache.axis.client.ServiceFactory.createService(ServiceFactory.java:198)
at com.bea.plateng.patch.AbstractPatchServicesImpl.init(AbstractPatchServicesImpl.java:90)
at com.bea.plateng.patch.DefaultPatchProducerServicesImpl.(DefaultPatchProducerServicesImpl.java:8)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at com.bea.plateng.patch.PatchServicesFactory.create(PatchServicesFactory.java:180)
at com.bea.plateng.patch.PatchLoginManager.login(PatchLoginManager.java:90)
at com.bea.plateng.patch.gui.PatchGUIHelper$1.call(PatchGUIHelper.java:192)
at com.bea.plateng.patch.gui.PatchGUIHelper$1.call(PatchGUIHelper.java:189)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:98)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:207)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:619)

Cause

Aha, we caught the fish: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: algorithm check failed: MD2withRSA is disabled

The problem is happening with latest version of Sun JDK from 160_18 onwards, Sun has disabled “MD2withRSA” with latest version of JDK’s stating that its vulnerability. This is Defect 9776340 in WebLogic.

Workaround

Use JRockit as the JVM instead. Suppose JRockit is installed in /opt/jrmc-4.0.0-1.6.0

1. Session Wide (temporary)

Open a terminal, set session wide environment variables:

export JAVA_HOME=/opt/jrmc-4.0.0-1.6.0/jre
export CLASSPATH=.
export PATH=$JAVA_HOME/bin:$PATH

run ./bsu.sh from this Termial

java -jar patch-client.jar

2. Permanent workaround

edit utils/bsu.sh

update JAVA_HOME

JAVA_HOME="/opt/jrmc-4.0.0-1.6.0/jre"

Run

./bsu.sh

Reference:

http://forums.oracle.com/forums/thread.jspa?threadID=1066924

About Me

Sydney, NSW, Australia
Keep Life Simple and Stupid:)

FriendFeed badge

Tags