Scope

The information from this article applies to connections between master and Agent that make use of JobScheduler Universal Agent - Secure HTTPS communication

Setting up a reverse proxy

[ssl:warn] [pid xxx] AH01909: RSA certificate configured for SERVER does NOT include an ID which matches the server name

When setting up a reverse proxy with Apache, you might the following warning in the log file ssl_error_log (per default the file is stored under /var/log/httpd):

...

In that case, follow the instructions as described in this post (have a look only at the answer marked with a ): http://serverfault.com/questions/578061/rsa-certificate-configured-for-server-does-not-include-an-id-which-matches-the-s

[ssl:warn] [pid xxx] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

When setting up a reverse proxy with Apache, you might the following warning in the log file ssl_error_log (per default the file is stored under /var/log/httpd):

...

In that case, follow the instructions as described in this article: http://sysadmin.compxtreme.ro/how-to-deal-with-rsa-server-certificate-is-a-ca-certificate-basicconstraints-ca-true-problem/

httpd service can not be restarted

Configuration errors

This might happen because there is an error in the Apache configuration (either in httpd.conf, in conf.d/ssl.conf or in any extra configuration file you would include). In order to know the reason why the service could not be started, type the following command:

journalctl -xelu httpd

Missing SELinux permissions

If there is no error in your Apache configuration and the service restart throws the following error:

...

Then you have to add the specific port you are doing the configuration for (in our case we use the port 24445 as in the example in the article JobScheduler Universal Agent - connecting via HTTPS through a proxy) to your system SELinux configuration and allow this port for httpd as follows:

sudo semanage port -a -t http_port_t -p tcp 24445

List of certificates in Java Truststore

In case you created a self-signed certificate and imported this certificate into the Java Truststore of JobScheduler Master, you can use the following command in order to see if the certificate was added properly to the Java Truststore and get the detailed information of the certificate:

"<path_to_java_for_jobscheduler>\bin\keytool" -list -keystore "<path_to_java_for_jobscheduler>\lib\security\cacerts" -storepass changeit

Setting Logging Level to Debug for Apache

Either in httpd.conf, in conf.d/ssl.conf or in an extra configuration file you would include in order to configure the reverse proxy,  add the following line to your configuration:

...

• ssl_access_log
• ssl_error_log
• ssl_request_log

Logging in JobScheduer Master

All informations you will find in the JobScheduler Master are located either in the order logs (under Order History) when starting an order for a job chain or in the task logs when starting a standalone job. Possible messages are described below.

[ WARN ] SCHEDULER-489 No remote JobScheduler is accessible. Waiting before trying again

If a warning like this is thrown in the order log:

...

[ERROR] Z-JAVA-105 Java exception spray.httpx.UnsuccessfulResponseException: Status: 503 Service Unavailable

If an error like this is thrown in the order log or the task log:

...