Symptoms
Depending on Strategy version used, this error message can be encountered in Strategy Library – while logging in/using bookmarks and in Workstation while using various features such as i.e. creating hypercards. It indicates issues with connection between Library server and Intelligence Server REST API port.
Action
- Verifying if the REST port is available. By default 34962 is used and it is necessary to check connectivity from Library server to I-Server machine. One way to achieve that would be to use telnet command:
telnet iserver_machine 34962
If the command fails – make sure the port is not closed i.e. in the Firewall.
- Checking Library Admin page to verify if it connects to the I-Server using TLS. If it does not- checking if I-Server has SSL disabled in the Configuration Wizard.
Checking StrategyLibrary-StrategyLibrary logs:
"message":"Unable to execute I-Server REST API. This might be caused by limitations on socket port for I-Server REST API. 2 https://xxxxxxxxx.techsupp.Strategy.com:34962/api/bulkreadobjects", 3"stack_trace":"javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 4 at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
Logs show that despite not using TLS to connect to the iserver, the reference to REST API port still uses HTTPS: (https://xxxxxxxxx.techsupp.Strategy.com:34962/api/bulkreadobject).
If TLS is not needed, disable TLS on I-Server, in the server definition.
If TLS is required- configure Library to use TLS when communicating with I-Server.
- Verifying if Library server can resolve hostname returned by the I-Server.
In StrategyLibrary-StrategyLibrary logs:
"message":"Unable to execute I-Server REST API. This might be caused by limitations on socket port for IServer REST API. 2 http://xxxxxxxxx.labs.Strategy.com:34962/api/usergroups/355C4A13404293AA7F76DF970FF3CGE6/settings", 3"stack_trace":"java.net.UnknownHostException: xxxxxxxxx.labs.Strategy.com 4 atjava.net.Inet6AddressImpl.lookupAllHostAddr(Native Method)
I-Server returns a URL to the Library server - http://iserver_hostname:34962/api. If the iserver_hostname cannot be resolved by DNS an error message referring to an unknown host will occur: java.net.UnknownHostException: xxxxxxxxxx.labs.Strategy.com.
Add the IP to hostname mapping (e.g. 10.67.24.10 xxxxxxxxxx.labs.Strategy.com) to the hosts file of the Library server machine to manually resolve the iserver name.
By default:
-Windows: C:\Windows\System32\drivers\etc\hosts
-Linux: /etc/host
CAUTION: Modifying the HOSTS file on a machine incorrectly can interfere with name resolution. Ensure that a backup copy is made of the HOSTS file before modifications are made. 4.
Verifying if the TLS ciphers are supported on the I-Server machine. In StrategyLibrary-StrategyLibrary logs:
"message":"Unable to execute I-Server REST API. This might be caused by limitations on socket port for IServer REST API.https://xxxxxxxxxx.Strategy.com:34962/api/bulkreadobjects","stack_trace":"java.net.SocketException: Connection reset at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)at java.base/java.net.SocketInputStream.read(SocketInputStream.java:140)
Library Server supports following secure cipher suites when TLSv1.2 is used:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
When none of them is enabled at the I-Server, I-Server would refuse the connection.
Solution is to enable the cipher suites at the I-Server machine. On Windows this can be achieved using e.g. tool called
IIS Crypto. For more details refer to
KB484612 .
