Accepted Solutions
Somehow it died checking the value in the database if tls1.2 mode is strict or not, then it tries to insert the values and fails.
Make sure you reboot before trying the update, this would clear up any resource issues that may be causing a problem.
Maybe check (d) below if you have a way to set up a new standalone primary, patch to be 8.3.0.6.0, then restore backup
from your PROD to the new test machine....and see if you can patch the test box, or have the same error....
------------------------------------------
a) Best idea is collect these mentioned logs and open a support case:
/opt/rsa/am/install_logs/dbscripts/CheckValueExists-20200622140537.log
/opt/rsa/am/install_logs/dbscripts/Insert values-20200622140538.log
or
b) check the database and see if you have the values (if they can even be returned or produce an error)
The table is ims_config_value
select * from ims_config_value where name like '%ssl_server.protocol%';
and this is how it would look if in Strict Mode. Yours on 8.3.x would/may also show sslv3 in the value text.
I wonder if there is a problem with this table or permissions as the log indicates it is trying to insert data and make it look like the above since 8.4 is forced to be strict and will drop sslv3....
c) in fact looking at the log some more...
a script runs to check status of TLS,
(my own 8.3.0.6.0 8.4 update log snippet---not in strict mode, so sslv3 is listed with the others)
Line 49: 22531 2018-12-12 15:09:45,902 INFO: Copying /tmp/rsa_update/iso/rsa/scripts/getStrictTls.sh to /tmp/rsa-install-2018-12-12-15-09-26/getStrictTls.sh
Line 51: 22945 2018-12-12 15:09:46,316 INFO: Changing permissions of /tmp/rsa-install-2018-12-12-15-09-26/getStrictTls.sh to 755
Line 74: 28464 2018-12-12 15:09:51,835 INFO: Performing preUpdate task InvokeGroovy (Config TLS)
Line 75: 28464 2018-12-12 15:09:51,835 INFO: ** Begin strict TLS check **
Line 81: 29344 2018-12-12 15:09:52,715 INFO: The existing property value is : SSLv3,TLSv1,TLSv1.1,TLSv1.2
Line 81: 29344 2018-12-12 15:09:52,715 INFO: The existing property value is : SSLv3,TLSv1,TLSv1.1,TLSv1.2
Line 81: 29344 2018-12-12 15:09:52,715 INFO: The existing property value is : SSLv3,TLSv1,TLSv1.1,TLSv1.2
Line 82: 29345 2018-12-12 15:09:52,716 INFO: TLSv1.2 is not enable
Line 84: 29380 2018-12-12 15:09:52,751 INFO: ** End strict TLS check **
The getstrictls script on 8.4 update does this weblogic check.
#!/bin/sh
REQ_PROTO_ARGS=( "-Dcom.rsa.requiredProtocols" "-Dweblogic.security.SSL.minimumProtocolVersion" )
WRAPPERS_DIR_PATH=$1
TLS_PROTOCOL="TLS"
TLS_PROTOCOL_1_2="TLSv1.2"
strict_tlsmode="NONE"
for protocolArgs in ${REQ_PROTO_ARGS
do
protoArgs=$(grep "\\$protocolArgs" $WRAPPERS_DIR_PATH)
if [ $? = 0 ]; then
count=$(echo $protoArgs | grep -i -o $TLS_PROTOCOL_1_2 | wc -l)
if [ $count -eq "1" ]; then
count=$(echo $protoArgs | grep -i -o $TLS_PROTOCOL | wc -l)
if [ $count -eq "1" ]; then
strict_tlsmode="STRICT_TLS"
fi
fi
fi
done
echo $strict_tlsmode
d) As a test only (make a backup of the system before proceeding!) and since this is standalone I suggest
restoring the backup to a new standalone 8.3.0.6.0 primary you do not care about, and try it there first:
[You are on vmware so you can take snapshots as well...and revert to snapshot if things get messy]
See if you can enable/disable tls1.2 mode from the command line, this will attempt to write settings
to the wrapper files which the script above attempts to check. It may just need this run (if you can enable
strict and it works, then set to false afterward)
On AM8.3:
rsaadmin@ci-05:~> cd /opt/rsa/am/utils/
rsaadmin@ci-05:/opt/rsa/am/utils> ./rsautil store -a enable_min_protocol_tlsv1_2 true restart
Please enter OC Administrator username: admin
Please enter OC Administrator password: *********
- TLS Configuration being updated ***
- Enabling TLS configurations in the wrapper files ***
- TLS configuration updated in the database ***
psql.bin:/tmp/8deebf17-ecab-4f56-a601-5a55841fc5865111216597879295968.sql:61: NOTICE: Updated the new configuration parameter "auth_manager.ssl_server.protoco l" with the value "TLSv1.2"
enable_min_protocol_tlsv1_2
-----------------------------
To revert this, do ./rsautil store -a enable_min_protocol_tlsv1_2 false restart
