Vinod Kumar Vavilapalli commented on YARN-2554:

I am talking about the server-side i.e. AMs. To use ssl to AM webapps,
 - the key-store needs to present on all machine to distribute certificates: 
AMs may come up anywhere.
 - the key-store used by Hadoop daemons *CANNOT* be shared with AMs: AMs run 
user-code as the user
 - the key-store cannot be shared across AMs of different users: Assuming I am 
running three different Slider apps as three different users, you don't want to 
have a single key-store instance accessible by all Slider AMs.
 - And distributing/installing/managing it per user is complex.

> Slider AM Web UI is inaccessible if HTTPS/SSL is specified as the HTTP policy
> -----------------------------------------------------------------------------
>                 Key: YARN-2554
>                 URL: https://issues.apache.org/jira/browse/YARN-2554
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: webapp
>    Affects Versions: 2.6.0
>            Reporter: Jonathan Maron
>         Attachments: YARN-2554.1.patch, YARN-2554.2.patch, YARN-2554.3.patch, 
> YARN-2554.3.patch
> If the HTTP policy to enable HTTPS is specified, the RM and AM are 
> initialized with SSL listeners.  The RM has a web app proxy servlet that acts 
> as a proxy for incoming AM requests.  In order to forward the requests to the 
> AM the proxy servlet makes use of HttpClient.  However, the HttpClient 
> utilized is not initialized correctly with the necessary certs to allow for 
> successful one way SSL invocations to the other nodes in the cluster (it is 
> not configured to access/load the client truststore specified in 
> ssl-client.xml).   I imagine SSLFactory.createSSLSocketFactory() could be 
> utilized to create an instance that can be assigned to the HttpClient.
> The symptoms of this issue are:
> AM: Displays "unknown_certificate" exception
> RM:  Displays an exception such as "javax.net.ssl.SSLHandshakeException: 
> sun.security.validator.ValidatorException: PKIX path building failed: 
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
> valid certification path to requested target"

This message was sent by Atlassian JIRA

Reply via email to