Unable to Use CLI Importer

Development
#1

When I try to use the CLI importer, I get the following error:

2019-06-07 16:00:52,857 2205       [      main] ERROR  formats.importer.cli.CommandLineImporter - Error during import process.
Ice.SecurityException: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at IceInternal.AsyncResultI.__wait(AsyncResultI.java:276) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.end_ice_isA(ObjectPrxHelperBase.java:310) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:92) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:69) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2810) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2770) ~[ice.jar:na]
        at Glacier2.RouterPrxHelper.checkedCast(RouterPrxHelper.java:1787) ~[glacier2.jar:na]
        at omero.client.getRouter(client.java:802) ~[blitz.jar:na]
        at omero.client.createSession(client.java:723) ~[blitz.jar:na]
        at omero.client.joinSession(client.java:658) ~[blitz.jar:na]
        at ome.formats.OMEROMetadataStoreClient.initialize(OMEROMetadataStoreClient.java:700) ~[blitz.jar:na]
        at ome.formats.importer.ImportConfig.createStore(ImportConfig.java:380) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.<init>(CommandLineImporter.java:170) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.main(CommandLineImporter.java:991) ~[blitz.jar:na]
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at sun.security.ssl.Handshaker.activate(Handshaker.java:509) ~[na:1.8.0_212]
        at sun.security.ssl.SSLEngineImpl.kickstartHandshake(SSLEngineImpl.java:714) ~[na:1.8.0_212]
        at sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:741) ~[na:1.8.0_212]
        at IceSSL.SSLEngine.createSSLEngine(SSLEngine.java:856) ~[ice.jar:na]
        at IceSSL.Instance.createSSLEngine(Instance.java:42) ~[ice.jar:na]
        at IceSSL.ConnectorI.connect(ConnectorI.java:30) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.nextConnector(OutgoingConnectionFactory.java:1101) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.access$100(OutgoingConnectionFactory.java:868) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.getConnection(OutgoingConnectionFactory.java:569) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.access$800(OutgoingConnectionFactory.java:14) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.getConnection(OutgoingConnectionFactory.java:1048) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.connectors(OutgoingConnectionFactory.java:932) ~[ice.jar:na]
        at IceInternal.EndpointHostResolver$1.run(EndpointHostResolver.java:103) ~[ice.jar:na]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_212]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_212]
        at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_212]

From the forums, I gathered this is due to the CLI using a weaker protocol then Omero’s SSL will accept. Omero.Web is working fine, however, and I was able to use the bulk import option a few weeks ago.

I tried doing the SSL tweak (Adding @SECLEVEL=0) which caused the server to fail with error.

InternalException: Failed to connect: exception ::Ice::PluginInitializationException
{
    reason = IceSSL: unable to set ciphers using `ADH:@SECLEVEL=0':
invalid command
}

For reference, I’m using Ubuntu 16.04 with the latest Open SSL version 1.0.2g-1ubuntu4.15.

I undid the SECLEVEL=0 fix and then I tried running the import with both --skip upgrade as well as --no-upgrade-check, neither of which fixed the original error. I’m not sure where to go from here, any advice?

#2

That’s quite a puzzle. It may depend on both the server- and the client-side state. For the server and for the client, which version of OMERO and OpenSSL is installed? (For OpenSSL is it 1.0.2g-1ubuntu4.15 on both?) It’s possible that upgrading at least the client to 5.4.10 could help if you’ve not already done so.

Will OMERO.insight let you import in the meantime or is that also giving trouble?

1 Like
#3

I forgot to ask: Also, which version of Java is running on the server and the client? “java -version” should say. (Or, feel free to point to Ubuntu package version if it’s installed via apt-get or whatever.)

#4

I’m running the CLI directly on the Omero server, so the OpenSSL version is the same. The Omero version is omero 5.4.9-ice36-b101.
Java version:

\openjdk version "1.8.0_212"
OpenJDK Runtime Environment (build 1.8.0_212-8u212-b03-0ubuntu1.16.04.1-b03)
OpenJDK 64-Bit Server VM (build 25.212-b03, mixed mode)

Maybe I’ll try updating Omero.Server to 5.4.10 like you say. Hopefully it’s easy.

Thanks for the help.

#5

I have a question about updating to 5.4.10:
I read that the BioInformatics caches will be invalidated, which I guess is fine (I don’t usually read the logs anyway). However, I would like to know if the configuration/plugins (Iviewer, FPBioImage, omero.Figure, etc) will be carried over or if I’d have to re-install them.

#6

The copying of config.xml in https://docs.openmicroscopy.org/omero/5.4.10/sysadmins/server-upgrade.html#id11 activates the same plugins that were activated previously. Their installation (whether globally via pip or in a virtualenv) should not change.

~Josh

#7

Ok, good to know.
I checked and I have ~23 gigabytes in my Bionformatics Cache, which seems like a lot.
Will each one be re-generated as soon as someone clicks on the image again for the first time?
Edit: Great news! The update worked, and the CLI is working now. The web client is working and all the plugins are showing as before.
Thanks for the help, Josh.

1 Like
#8

Hi,
since a few days I’m getting the exact same error that @pmann reported above. I have been on OMERO 5.4.10 for a while and CLI importing has worked fine until a few days ago. I have done some regular apt-get updating about a week ago and while I don’t remember the exact sequence, that may be when the problem started. So I also have Ubuntu 16.04.1, with OpenSSL 1.0.2g and Java 1.8.0_212. Any ideas?
Thanks,

  • Damir
#9

Quick update: I looked back at some earlier discussions on this and found a mention of the --skip upgrade option. And that works … but still very weird. Did something I upgraded with apt-get upgrade effectively cause a regression?
Damir

#10

@dsudar I suspect the Java version is the culprit here. OMERO 5.4.10 was released end of January to address this issue for OMERO.insight specifically as the client Java environments (mostly Oracly JDK based) were getting upgraded and exposed to the changes.

Eventually, the upstream changes have made into OpenJDK and the base packages of the various Linux distributions. For instance, the CentOS 7-based IDR servers started being affected by the same issue in March 2019.

If you need to stay on OMERO 5.4, bin/omero --skip upgrade should allow yo to use the CLI importer with a recent Java version as you noticed. More generally, we released a fix for this issue in OMERO 5.5.0. Depending on your timeframe, it might be worth looking into upgrading your system at some point to get rid of the workaround.

Best,
Sebastien

#11

Hi @s.besson Yes, looking back at my recent apt-get upgrades, it looks like OpenJDK was indeed upgraded at that time. So that makes sense. I had been putting off the upgrade to 5.5 because being busy but I guess this is a good reason to make the time for it.
Cheers,
Damir