Unable to Use CLI Importer

When I try to use the CLI importer, I get the following error:

2019-06-07 16:00:52,857 2205       [      main] ERROR  formats.importer.cli.CommandLineImporter - Error during import process.
Ice.SecurityException: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at IceInternal.AsyncResultI.__wait(AsyncResultI.java:276) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.end_ice_isA(ObjectPrxHelperBase.java:310) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:92) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.ice_isA(ObjectPrxHelperBase.java:69) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2810) ~[ice.jar:na]
        at Ice.ObjectPrxHelperBase.checkedCastImpl(ObjectPrxHelperBase.java:2770) ~[ice.jar:na]
        at Glacier2.RouterPrxHelper.checkedCast(RouterPrxHelper.java:1787) ~[glacier2.jar:na]
        at omero.client.getRouter(client.java:802) ~[blitz.jar:na]
        at omero.client.createSession(client.java:723) ~[blitz.jar:na]
        at omero.client.joinSession(client.java:658) ~[blitz.jar:na]
        at ome.formats.OMEROMetadataStoreClient.initialize(OMEROMetadataStoreClient.java:700) ~[blitz.jar:na]
        at ome.formats.importer.ImportConfig.createStore(ImportConfig.java:380) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.<init>(CommandLineImporter.java:170) ~[blitz.jar:na]
        at ome.formats.importer.cli.CommandLineImporter.main(CommandLineImporter.java:991) ~[blitz.jar:na]
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at sun.security.ssl.Handshaker.activate(Handshaker.java:509) ~[na:1.8.0_212]
        at sun.security.ssl.SSLEngineImpl.kickstartHandshake(SSLEngineImpl.java:714) ~[na:1.8.0_212]
        at sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:741) ~[na:1.8.0_212]
        at IceSSL.SSLEngine.createSSLEngine(SSLEngine.java:856) ~[ice.jar:na]
        at IceSSL.Instance.createSSLEngine(Instance.java:42) ~[ice.jar:na]
        at IceSSL.ConnectorI.connect(ConnectorI.java:30) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.nextConnector(OutgoingConnectionFactory.java:1101) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.access$100(OutgoingConnectionFactory.java:868) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.getConnection(OutgoingConnectionFactory.java:569) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory.access$800(OutgoingConnectionFactory.java:14) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.getConnection(OutgoingConnectionFactory.java:1048) ~[ice.jar:na]
        at IceInternal.OutgoingConnectionFactory$ConnectCallback.connectors(OutgoingConnectionFactory.java:932) ~[ice.jar:na]
        at IceInternal.EndpointHostResolver$1.run(EndpointHostResolver.java:103) ~[ice.jar:na]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) ~[na:1.8.0_212]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) ~[na:1.8.0_212]
        at java.lang.Thread.run(Thread.java:748) ~[na:1.8.0_212]

From the forums, I gathered this is due to the CLI using a weaker protocol then Omero’s SSL will accept. Omero.Web is working fine, however, and I was able to use the bulk import option a few weeks ago.

I tried doing the SSL tweak (Adding @SECLEVEL=0) which caused the server to fail with error.

InternalException: Failed to connect: exception ::Ice::PluginInitializationException
{
    reason = IceSSL: unable to set ciphers using `ADH:@SECLEVEL=0':
invalid command
}

For reference, I’m using Ubuntu 16.04 with the latest Open SSL version 1.0.2g-1ubuntu4.15.

I undid the SECLEVEL=0 fix and then I tried running the import with both --skip upgrade as well as --no-upgrade-check, neither of which fixed the original error. I’m not sure where to go from here, any advice?

That’s quite a puzzle. It may depend on both the server- and the client-side state. For the server and for the client, which version of OMERO and OpenSSL is installed? (For OpenSSL is it 1.0.2g-1ubuntu4.15 on both?) It’s possible that upgrading at least the client to 5.4.10 could help if you’ve not already done so.

Will OMERO.insight let you import in the meantime or is that also giving trouble?

1 Like

I forgot to ask: Also, which version of Java is running on the server and the client? “java -version” should say. (Or, feel free to point to Ubuntu package version if it’s installed via apt-get or whatever.)

I’m running the CLI directly on the Omero server, so the OpenSSL version is the same. The Omero version is omero 5.4.9-ice36-b101.
Java version:

\openjdk version "1.8.0_212"
OpenJDK Runtime Environment (build 1.8.0_212-8u212-b03-0ubuntu1.16.04.1-b03)
OpenJDK 64-Bit Server VM (build 25.212-b03, mixed mode)

Maybe I’ll try updating Omero.Server to 5.4.10 like you say. Hopefully it’s easy.

Thanks for the help.

I have a question about updating to 5.4.10:
I read that the BioInformatics caches will be invalidated, which I guess is fine (I don’t usually read the logs anyway). However, I would like to know if the configuration/plugins (Iviewer, FPBioImage, omero.Figure, etc) will be carried over or if I’d have to re-install them.

The copying of config.xml in https://docs.openmicroscopy.org/omero/5.4.10/sysadmins/server-upgrade.html#id11 activates the same plugins that were activated previously. Their installation (whether globally via pip or in a virtualenv) should not change.

~Josh

Ok, good to know.
I checked and I have ~23 gigabytes in my Bionformatics Cache, which seems like a lot.
Will each one be re-generated as soon as someone clicks on the image again for the first time?
Edit: Great news! The update worked, and the CLI is working now. The web client is working and all the plugins are showing as before.
Thanks for the help, Josh.

1 Like