carbon-kernel
carbon-kernel copied to clipboard
Silently failing on hazelcast certificate issue without any logs and crashes the server
Moved from https://wso2.org/jira/browse/IDENTITY-7272
Issue:
When clustering is enabled and clustering method is AWS if the access keys or the certificate is not valid Hazelcast initialization is not continuing and no error logs have been logged. Also can't access the management console as 9443 port is closed.
But when hazelcast logging is enabled there is a warning log and exception log get printed.
WARN
{com.hazelcast.cluster.impl.TcpIpJoinerOverAWS} - [10.79.142.95]:5701 [wso2.carbon.domain] [3.5.2] sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
FATAL {com.hazelcast.cluster.impl.TcpIpJoinerOverAWS}
- [10.79.142.95]:5701 [wso2.carbon.domain] [3.5.2] javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
com.hazelcast.core.HazelcastException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Can we add proper logs to track this scenario?
Reproduce Steps:
- Get a IS 5.0.0 fresh pack
- Set up the cluster in aws mode (https://docs.wso2.com/display/CLUSTER44x/Setting+up+a+Cluster+in+AWS+Mode)
- Give wrong access keys
- Change the "localMemberHost" to an IP address.
- Run the server with and without -Dhazelcast.logging.type=log4j to see the difference in logs with and without hazelcast logging.