Unable to Enable Operational Reports Server: SRM-RIB SSL Handshake Exception - DX NetOps Performance Management

Products

• Network Observability
• CA Performance Management

Issue/Introduction

This article explains how to resolve an SSL handshake failure preventing the enablement of the Operational Reports Server (ORS) when the SRM-RIB service cannot establish a secure connection due to trust store misconfiguration.

Symptoms

• Unable to enable the Operational Reports Server.
• Log files (PCService.log or OperationalReportsServer.log) report the following errors:
  • javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
  • java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
  • UnauthorizedException: HTTP 401 Unauthorized

Environment

• DX NetOps Performance Management
• SRM-RIB Service enabled with HTTPS

Cause

The srm-rib-jetty.conf file is incorrectly configured with JAVA_ADDITIONAL_2 pointing to the Portal's Jetty identity keystore. This keystore contains the Portal's private key but lacks the necessary trusted CA certificates (Trust Anchors), causing the outbound client to fail validation during the HTTPS handshake.

Resolution

Perform the following steps to populate the trust store and update the configuration:

1. Extract Certificates: Extract the root and intermediate CA certificates from the SRM-RIB jetty keystore: 
   
   openssl pkcs12 -in /opt/CA/srm-rib/jetty/etc/keystore -nokeys -passin pass:changeit -out /tmp/srm-rib-certs.pem 

 csplit -z -f /tmp/cert- -b '%02d.pem' /tmp/srm-rib-certs.pem '/-----BEGIN CERTIFICATE-----/' '{*}'

2. Verify Certificates: Identify the root and intermediate CA files: 
   
   for f in /tmp/cert-*.pem; do echo "== $f =="; openssl x509 -in "$f" -noout -subject -issuer; done

3. Import as Trusted Entries: Import these certificates into the keystore referenced by JAVA_ADDITIONAL_2 (typically /opt/CA/PerformanceCenter/jetty/etc/keystore): 
   
   keytool -importcert -noprompt -alias rwe-ica-2024 -file /tmp/cert-0X.pem -keystore /opt/CA/PerformanceCenter/jetty/etc/keystore -storepass changeit 

keytool -importcert -noprompt -alias rwe-root-ca-r23 -file /tmp/cert-0Y.pem -keystore /opt/CA/PerformanceCenter/jetty/etc/keystore -storepass changeit
   
   

4. Update Configuration: Add the missing system property to /opt/CA/srm-rib/conf/srm-rib-jetty.conf:
    JAVA_ADDITIONAL_3=-Djavax.net.ssl.trustStorePassword=changeit

5. Restart Service: Restart the service to apply the changes: systemctl restart srm-rib.service

6. Verification: Verify the keystore contains the required entries: keytool -list -keystore /opt/CA/PerformanceCenter/jetty/etc/keystore -storepass changeit 
   The keystore should display the private key entry and the two new trusted certificates. Check the OperationalReportsServer.log to confirm the handshake is now successful.