no cipher suites in common error using OpenEdge ESB Native Invocation Service with a secure SSL appserver

Dec 16, 2021
Knowledge

Title

URL Name

no-cipher-suites-in-common-error-using-OpenEdge-ESB-Native-Invocation-Service-with-a-secure-SSL-appserver

Article Number

000207003

Environment

OpenEdge-OE App Server Enterprise-Linux-Centos 7 Product: OpenEdge Version:11.7.x OS: All supported platforms Other:Sonic ESB

Question/Problem Description

no cipher suites in common error using OpenEdge ESB Native Invocation Service with a secure SSL appserver

An OpenEdge Native Invocation Service is called by a Sonic ESB process in order to run some application code on a secure OpenEdge classic appserver. The Native Invocation request works when the appserver security is disabled.
But when the appserver is configured for SSL the request fails.

The Sonic MF container hosting the ESB process only knows that the request failed for some reason. This results in a handshake failure in the MF container log:

[21/11/24 03:39:26] ID=esbCase2832 (severe) Bq.OESync.srv.OENative.00055.RO.TLS [-----------------] XID write IOException: javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
[21/11/24 03:39:26] ID=esbCase2832 (severe) Bq.OESync.srv.OENative.00055.RO.TLS [-----------------]
[21/11/24 03:39:26] ID=esbCase2832 (severe) Trace follows...
com.progress.open4gl.broker.BrokerException: General Error: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
   at com.progress.ubroker.client.BrokerSystem.processXID(BrokerSystem.java:2041)
   at com.progress.ubroker.client.BrokerSystem.xid(BrokerSystem.java:855)
   at com.progress.open4gl.dynamicapi.Session.connect(Session.java:268)
   at com.progress.open4gl.dynamicapi.SessionPool$BrokerSessionList.reserveSession(SessionPool.java:769)
   at com.progress.open4gl.dynamicapi.SessionPool.reserveSession(SessionPool.java:3425)
   at com.progress.open4gl.dynamicapi.SessionPool.createSession(SessionPool.java:2346)
   at com.progress.open4gl.dynamicapi.SessionPool.initializePool(SessionPool.java:3724)
   at com.progress.open4gl.dynamicapi.SessionPool.<init>(SessionPool.java:2112)
   at com.progress.open4gl.dynamicapi.SessionPool.createPool(SessionPool.java:1905)
   at com.progress.open4gl.javaproxy.ProObject.<init>(ProObject.java:203)
   at com.progress.open4gl.javaproxy.AppObject.<init>(AppObject.java:93)
   at com.progress.open4gl.javaproxy.OpenAppObjectImpl.<init>(OpenAppObjectImpl.java:27)
   at com.progress.open4gl.javaproxy.OpenAppObject.<init>(OpenAppObject.java:76)
   at com.progress.esb.adapter.OpenClient.getAppObj(OpenClient.java:111)
   at com.progress.esb.adapter.OpenClient.runProcedure(OpenClient.java:383)
   at com.progress.esb.adapter.OpenClient.execute(OpenClient.java:949)
   at com.progress.esb.adapter.OEScriptCommand.execute(OEScriptCommand.java:61)
   at com.progress.esb.adapter.OEInvocationScriptObject$OEInvocationScriptCommand.execute(OEInvocationScriptObject.java:144)
   at com.sonicsw.xqimpl.script.Command.executeScriptCommand(Command.java:330)
   at com.sonicsw.xqimpl.script.Command.execute(Command.java:286)
   at com.progress.esb.adapter.EsbAdapter2.service(EsbAdapter2.java:350)
   at com.sonicsw.xqimpl.service.ServiceMessageHandler.callService(ServiceMessageHandler.java:474)
   at com.sonicsw.xqimpl.service.ServiceMessageHandler.handleMessageCommon(ServiceMessageHandler.java:250)
   at com.sonicsw.xqimpl.service.ServiceMessageHandler.handleMessage(ServiceMessageHandler.java:137)
   at com.sonicsw.xqimpl.service.XQDispatcher.onMessage(XQDispatcher.java:469)
   at com.sonicsw.esb.itinerary.model.EsbStepNode.doExecute(EsbStepNode.java:310)
   at com.sonicsw.esb.itinerary.model.EsbStepNode.execute(EsbStepNode.java:185)
   at com.sonicsw.esb.process.model.impl.DefaultActivityNode.offerIncoming(DefaultActivityNode.java:150)
   at com.sonicsw.esb.process.model.impl.DefaultActivityEdge.place(DefaultActivityEdge.java:79)
   at com.sonicsw.esb.process.model.impl.DefaultActivityNode.offerOutgoing(DefaultActivityNode.java:213)
   at com.sonicsw.esb.itinerary.engine.ItineraryEngine.enqueueToken(ItineraryEngine.java:219)
   at com.sonicsw.esb.process.model.impl.DefaultActivityNode.offerIncoming(DefaultActivityNode.java:155)
   at com.sonicsw.esb.process.model.impl.DefaultMainProcess.initiate(DefaultMainProcess.java:97)
   at com.sonicsw.esb.itinerary.engine.ItineraryEngine.initiateProcess(ItineraryEngine.java:284)
   at com.sonicsw.esb.itinerary.engine.ItineraryEngine.handleToken(ItineraryEngine.java:184)
   at com.sonicsw.xqimpl.service.MessageSendingHelper.sendToProcess(MessageSendingHelper.java:389)
   at com.sonicsw.xqimpl.service.MessageSendingHelper.sendToAddress(MessageSendingHelper.java:88)
   at com.sonicsw.xqimpl.service.MessageSendingHelper.sendEnvelopes(MessageSendingHelper.java:499)
   at com.sonicsw.xqimpl.service.XQDispatcher.sendOutboxAndFaultMessages(XQDispatcher.java:597)
   at com.sonicsw.xqimpl.service.XQDispatcher.onMessage(XQDispatcher.java:517)
   at com.sonicsw.xqimpl.endpoint.container.EndpointContextContainer.onMessage(EndpointContextContainer.java:120)
   at com.sonicsw.xq.connector.jms.JMSEndpointMessageListener.onMessage(JMSEndpointMessageListener.java:277)
   at progress.message.jimpl.Session.deliver(Session.java:3192)
   at progress.message.jimpl.Session.run(Session.java:2576)
   at progress.message.jimpl.Session$SessionThread.run(Session.java:2973)

[21/11/24 03:39:26] ID=esbCase2832 (warning) Bq.OESync.srv.OENative.00055.RO.TLS [Native Invocation] Unable to connect to OpenEdge AppServer: SessionPool : NoAvailableSessions[Could not connect to the AppServer: General Error: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure. (7203)] (14709)

The error in the appserver broker log indicates the problem is due to a mismatch in ciphers between the Native Invocation service and the appserver:

[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB ----------- IOException received on client connection no cipher suites in common : {1}. (8085)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB ----------- javax.net.ssl.SSLHandshakeException: no cipher suites in common
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:292)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.ServerHandshaker.chooseCipherSuite(ServerHandshaker.java:1035)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.ServerHandshaker.clientHello(ServerHandshaker.java:738)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:221)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:928)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at sun.security.ssl.AppInputStream.read(AppInputStream.java:105)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at java.io.BufferedInputStream.fill(BufferedInputStream.java:246)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at java.io.BufferedInputStream.read1(BufferedInputStream.java:286)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at java.io.BufferedInputStream.read(BufferedInputStream.java:345)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.util.MsgInputStream.readstream(MsgInputStream.java:440)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.util.MsgInputStream.readubhdr(MsgInputStream.java:278)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.util.MsgInputStream.readMsg(MsgInputStream.java:155)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.broker.ubClientThread.solicitEvent(ubClientThread.java:887)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.broker.ubClientThread.mainline(ubClientThread.java:433)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 1 UB -----------    at com.progress.ubroker.broker.ubClientThread.run(ubClientThread.java:361)
[21/11/24@12:52:38.904+0300] P-511945 T-C-0002 3 UB Basic IOException received on client connection C-0002 : no cipher suites in common. (8085)

The problem happens when the Native Invocation service has the default ciphers specified or with "AES128-SHA256,DHE-RSA-AES128-SHA256":

Steps to Reproduce

Clarifying Information

A private key is being specified for the SSL connection to the appserver:

Error Message

IOException received on client connection no cipher suites in common : {1}. (8085)

Defect Number

Enhancement Number

Cause

There are two reasons why this is happening:

The format of the private key isn't correct. The key header when opened in Notepad++ displays "BEGIN ECRYPTED PRIVATE KEY" when it should have contained "BEGIN RSA PRIVATE KEY".
The specified key.pem file only contained the private key. It also needs to have the certificate appended to it.

Resolution

From a PROENV session, use the sslc command to convert the private key to the correct format, for example:

sslc rsa -in key.pem -des3 -out key_rsa.pem.

After this when viewed in Notepad, the 'key_rsa.pem' file should contain the header and footer:

-----BEGIN RSA PRIVATE KEY-----
< encrypted key data >
-----END RSA PRIVATE KEY-----

In Notepad open the new .pem file and append the certificate to the private key, e.g.:

-----BEGIN RSA PRIVATE KEY-----
< encrypted key data >
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
< encrypted certificate data >
-----END CERTIFICATE-----

Stop the appserver and then make sure it uses the new key_rsa.pem file in it's configuration SSL Tab.

Restart the appserver.

Workaround

Notes

Progress Article(s):
000118283, SSL client raises (9991) with certificate message

Keyword Phrase

Last Modified Date

12/16/2021 10:48 AM

no cipher suites in common error using OpenEdge ESB Native Invocation Service with a secure SSL appserver

Files(0)

Was this article helpful?

Was this article helpful?

no cipher suites in common error using OpenEdge ESB Native Invocation Service with a secure SSL appserver

Information

Related Articles