Tuesday, April 16, 2019

Enterprise Manager Database Control Configuration/Certificate issue after upgrading 10.2.0.1 to 10.2.0.5

Issue:
bash-5.0$ emctl start dbconsole
Oracle Enterprise Manager 10g Database Control Release 10.2.0.5.0
Copyright (c) 1996, 2010 Oracle Corporation.  All rights reserved.
https:/hostname:1158/em/console/aboutApplication
ps: cmd is not a valid field name
Starting Oracle Enterprise Manager 10g Database Control ............................................................ failed.
------------------------------------------------------------------
Logs are generated in directory /u01/app/oracle/OraHome_1/<hostname_sid>/sysman/log
bash-5.0$ ./emctl status dbconsole
Oracle Enterprise Manager 10g Database Control Release 10.2.0.5.0
Copyright (c) 1996, 2010 Oracle Corporation.  All rights reserved.
https://hostname:1158/em/console/aboutApplication
Oracle Enterprise Manager 10g is not running.

Checking the ORACLE_HOME\<hostname>_<SID>\sysman\log\emagent.trc, below errors can see also:

2019-04-12 10:49:29 Thread-5 ERROR http: 16: Unable to initialize ssl connection with server, aborting connection attempt
2019-04-12 10:49:29 Thread-5 ERROR command: nmejcn: failed http connection to https://hostname:1158/em/upload/: retStatus=-1
2019-04-12 10:49:30 Thread-24 ERROR upload: Error in uploadXMLFiles.  Trying again in 103.00 seconds.
2019-04-12 10:49:34 Thread-25 ERROR upload: Error in uploadXMLFiles.  Trying again in 123.00 seconds.
2019-04-12 10:49:39 Thread-28 ERROR upload: Error in uploadXMLFiles.  Trying again in 147.00 seconds.
2019-04-12 10:49:45 Thread-5 ERROR ssl: Open wallet failed, ret = 28750
2019-04-12 10:49:45 Thread-5 ERROR ssl: nmehlenv_openWallet failed

(or)

2019-04-12 12:14:18 Thread-128 ERROR ssl: nzos_Handshake failed, ret=28862
2019-04-12 12:14:18 Thread-128 ERROR http: 15: Error initializing SSL connection for incoming request, aborting request. ret=-1


Cause:
In Enterprise Manager (EM) Database Control with Oracle Database 10.2.0.4 and 10.2.0.5, the root certificate used to secure communications via the Secure Socket Layer (SSL) protocol will expire on 31-Dec-2010 00:00:00. The certificate expiration will cause errors if you attempt to configure Database Control on or after 31-Dec-2010.Existing Database Control configurations are not impacted by this issue.

Solution:

1. Stop database,listener and em services.
2. Download and apply patch
bash-5.0$ /u01/app/oracle/OraHome_1/OPatch/opatch apply
Invoking OPatch 10.2.0.4.9

Oracle Interim Patch Installer version 10.2.0.4.9
Copyright (c) 2009, Oracle Corporation.  All rights reserved.


Oracle Home       : /u01/app/oracle/OraHome_1
Central Inventory : /u01/app/oracle/oraInventory
   from           : /var/opt/oracle/oraInst.loc
OPatch version    : 10.2.0.4.9
OUI version       : 10.2.0.5.0
OUI location      : /u01/app/oracle/OraHome_1/oui
Log file location : /u01/app/oracle/OraHome_1/cfgtoollogs/opatch/opatch2019-04-12_11-34-01AM.log

Patch history file: /u01/app/oracle/OraHome_1/cfgtoollogs/opatch/opatch_history.txt

ApplySession applying interim patch '8350262' to OH '/u01/app/oracle/OraHome_1'

Running prerequisite checks...

OPatch detected non-cluster Oracle Home from the inventory and will patch the local system only.

Backing up files and inventory (not for auto-rollback) for the Oracle Home
Backing up files affected by the patch '8350262' for restore. This might take a while...
Backing up files affected by the patch '8350262' for rollback. This might take a while...

Patching component oracle.sysman.agent.core, 10.2.0.5.0a...
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emCORE.jar" with "/sysman/jlib/emCORE.jar/oracle/sysman/eml/sec/fsc/FSWalletUtil.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emCORE.jar" with "/sysman/jlib/emCORE.jar/oracle/sysman/eml/sec/rep/RepWalletUtil.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emCORE.jar" with "/sysman/jlib/emCORE.jar/oracle/sysman/eml/sec/util/RootCert.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emCORE.jar" with "/sysman/jlib/emCORE.jar/oracle/sysman/eml/sec/util/SecConstants.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emd_java.jar" with "/sysman/jlib/emd_java.jar/oracle/sysman/eml/sec/fsc/FSWalletUtil.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emd_java.jar" with "/sysman/jlib/emd_java.jar/oracle/sysman/eml/sec/rep/RepWalletUtil.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emd_java.jar" with "/sysman/jlib/emd_java.jar/oracle/sysman/eml/sec/util/RootCert.class"
Updating jar file "/u01/app/oracle/OraHome_1/sysman/jlib/emd_java.jar" with "/sysman/jlib/emd_java.jar/oracle/sysman/eml/sec/util/SecConstants.class"
ApplySession adding interim patch '8350262' to inventory

Verifying the update...
Inventory check OK: Patch ID 8350262 is registered in Oracle Home inventory with proper meta-data.
Files check OK: Files from Patch ID 8350262 are present in Oracle Home.

OPatch succeeded.
bash-5.0$ /u01/app/oracle/OraHome_1/OPatch/opatch lsinventory
Invoking OPatch 10.2.0.4.9

Oracle Interim Patch Installer version 10.2.0.4.9
Copyright (c) 2009, Oracle Corporation.  All rights reserved.


Oracle Home       : /u01/app/oracle/OraHome_1
Central Inventory : /u01/app/oracle/oraInventory
   from           : /var/opt/oracle/oraInst.loc
OPatch version    : 10.2.0.4.9
OUI version       : 10.2.0.5.0
OUI location      : /u01/app/oracle/OraHome_1/oui
Log file location : /u01/app/oracle/OraHome_1/cfgtoollogs/opatch/opatch2019-04-12_11-34-25AM.log

Patch history file: /u01/app/oracle/OraHome_1/cfgtoollogs/opatch/opatch_history.txt

Lsinventory Output file location : /u01/app/oracle/OraHome_1/cfgtoollogs/opatch/lsinv/lsinventory2019-04-12_11-34-25AM.txt

--------------------------------------------------------------------------------
Installed Top-level Products (2):

Oracle Database 10g                                                  10.2.0.1.0
Oracle Database 10g Release 2 Patch Set 4                            10.2.0.5.0
There are 2 products installed in this Oracle Home.


Interim patches (1) :

Patch  8350262      : applied on Fri Apr 12 11:34:11 IST 2019
Unique Patch ID:  13011832
   Created on 13 Sep 2010, 14:09:12 hrs GMT
   Bugs fixed:
     8350262

--------------------------------------------------------------------------------

OPatch succeeded.

3. Start database and listener services.
4. Re-secure Database Control with the following command:
   <ORACLE_HOME>/bin/emctl secure dbconsole -reset
You will be prompted twice to confirm that the Root key must be overwritten. In both cases, enter upper-case "Y" as the response. Any other response (including lower-case "y") will cause the command to terminate without completing. If this happens, the command can be re-invoked.

bash-5.0$ emctl secure dbconsole -reset
Oracle Enterprise Manager 10g Database Control Release 10.2.0.5.0
Copyright (c) 1996, 2010 Oracle Corporation.  All rights reserved.
http://hostname:1158/em/console/aboutApplication
Enter Enterprise Manager Root Password :
DBCONSOLE already stopped...   Done.
Agent is already stopped...   Done.
Securing dbconsole...   Started.
Checking Repository...   Done.
Checking Em Key...   Done.
Checking Repository for an existing Enterprise Manager Root Key...
WARNING! An Enterprise Manager Root Key already exists in
the Repository. This operation will replace your Enterprise
Manager Root Key.
All existing Agents that use HTTPS will need to be
reconfigured if you proceed. Do you wish to continue and
overwrite your Root Key
(Y/N) ?
Y
Are you sure ? Reset of the Enterprise Manager Root Key
will mean that you will need to reconfigure each Agent
that is associated with this OMS before they will be
able to upload any data to it. Monitoring of Targets
associated with these Agents will be unavailable until
after they are reconfigured.
(Y/N) ?
Y
Generating Enterprise Manager Root Key (this takes a minute)...   Done.
Fetching Root Certificate from the Repository...   Done.
Updating HTTPS port in emoms.properties file...   Done.
Generating Java Keystore...   Done.
Securing OMS ...   Done.
Generating Oracle Wallet Password for Agent....   Done.
Generating wallet for Agent ...    Done.
Copying the wallet for agent use...    Done.
Storing agent key in repository...   Done.
Storing agent key for agent ...   Done.
Configuring Agent...
Configuring Agent for HTTPS in DBCONSOLE mode...   Done.
EMD_URL set in /u01/app/oracle/OraHome_1/<hostname_sid>/sysman/config/emd.properties
   Done.
Configuring Key store..   Done.
Securing dbconsole...   Sucessful.

5. Re-start Database Control with the following command:

   <ORACLE_HOME>/bin/emctl start dbconsole
bash-5.0$ emctl start dbconsole
Oracle Enterprise Manager 10g Database Control Release 10.2.0.5.0
Copyright (c) 1996, 2010 Oracle Corporation.  All rights reserved.
https://hostname>:1158/em/console/aboutApplication
ps: cmd is not a valid field name
Starting Oracle Enterprise Manager 10g Database Control .................... started.
------------------------------------------------------------------
Logs are generated in directory /u01/app/oracle/OraHome_1/<hostname_sid>/sysman/log

6. Verify Database Control status with the following command:

bash-5.0$ emctl status dbconsole
Oracle Enterprise Manager 10g Database Control Release 10.2.0.5.0
Copyright (c) 1996, 2010 Oracle Corporation.  All rights reserved.
https://hostname:1158/em/console/aboutApplication
Oracle Enterprise Manager 10g is running.
------------------------------------------------------------------
Logs are generated in directory /u01/app/oracle/OraHome_1/<hostname_sid>/sysman/log

No comments:

Post a Comment