[gpfsug-discuss] RHEL7, Scale 5, GUI CSR

[Chase, Peter]

Afternoon all,

I've hit a problem with our Spectrum Scale GUI.
It's on 5.1.3.1, and running OS is RHEL 7.
When I try to generate a CSR in the GUI with a Subject Alternative Name set I get the following error:
Error: EFSSG1159A Openssl failed to run the specified command.
At least openssl version 1.1.1 is needed on the GUI node to use Subject Alternative Names. Please upgrade it and try again.

I've installed the latest OpenSSL11 RPM from EPEL, but I'm not able to get the Scale GUI to make use of it.
RHEL 7 runs the GUI as a systemd service. The user in the unit file is scalemgmt. The environment variables get set from a EnvironmentFile directive pointing at /etc/sysconfig/gpfsgui.
I've updated the PATH variable set in /etc/sysconfig/gpfsgui to have /home/scalemgmt/bin before /bin, and added a symlink to openssl11 as openssl in that directory.
I've confirmed that it works by running interactivity with the user scalemgmt, sourcing the file and running openssl , which results in the 1.1.1 version opening.

But that hasn't worked for the GUI, and I get the same error. So I've explicitly sourced the file in scalemgmt's .bash_profile, and that's made no difference either.
I've trapped for the command running with ps and can see it really is running as the scalemgmt user, and GPFS isn't doing some magic to run as a different user.

As a last ditch, I've created a /usr/lib/systemd/system/gpfsgui.service.d directory, and added a path.conf file to specify the PATH as I want it with an environment directive, and that has also made no difference.

So, I'm wondering if anyone else has experienced such a problem, and how they managed to get it working (short of generating a CSR with SSL command line and working out which java keystore to stuff it into).

Sincerely,

Peter Chase
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://gpfsug.org/pipermail/gpfsug-discuss_gpfsug.org/attachments/20220512/de17c3cb/attachment-0001.htm>