Mailing List ArchivesAuthenticated access |
![[Computer Systems Lab]](http://www.cs.wisc.edu/pics/csl_logo.gif){kind=logo}
|
Mailing List ArchivesAuthenticated access |
|
At KIT, we updated the EPs to condor version 24.0.14 RHEL8 and afterwards OpenSSL to 3.5.1 on the APs again. The APs are still 25.0.3 RHEL9. We see no error since the update. The new condor version fixed the issue.
Regards,
Matthias
What version of HTCondor are your EPs running? They need to be running 24.0.7 or later as well.
Â- Jaime
On Nov 24, 2025, at 2:54âPM, Steven Timm <timm@xxxxxxxx> wrote:
We were previously at openssl 3.2.2.A quick upgrade of one of the affected schedds to 24.0.14 appears to have reduced the frequency but not totally eliminated the error.
Alma linux 9 went from openssl 3.2.2 to 3.5.1. As Alma 9.7 rolled out,ÂAbout a month after RHEL did the same.
Steve Timm
From:ÂJaime Frey <jfrey@xxxxxxxxxxx>
Sent:ÂMonday, November 24, 2025 2:47 PM
To:ÂHTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Cc:ÂSteven Timm <timm@xxxxxxxx>; Hyunwoo Kim <hyunwoo@xxxxxxxx>
Subject:ÂRe: [HTCondor-users] Problems with OpenSSL 3.5.1Â[EXTERNAL] â This message is from an external senderWhat version of openssl was installed previously? When we made this fix, proxy delegation was failing in openssl 3.4.0.We will have to investigate whether openssl 3.5.1 is introducing a new problem.
Â- Jaime
On Nov 24, 2025, at 11:49âAM, Steven Timm via HTCondor-users <htcondor-users@xxxxxxxxxxx> wrote:
As of this morning, when openssl 3.5.1 yum updates hit our Alma 9 systems, we are now seeing the same error message that was initially reported by the original poster in this thread. However our machines are running htcondor 24.0.7 which was supposed to have a fix.
On schedd machine we see:
11/24/25 09:31:46 (61311.45) (3741562): Delegation error:11/24/25 09:31:46 (61311.45) (3741562): ReliSock::put_x509_delegation(): delegation failed: X509Credential::Delegate() failed11/24/25 09:31:46 (61674.165) (3741587): Delegation error: C0278C15717F0000:error:05800091:x509 certificate routines:X509_REQ_verify_ex:unsupported version:crypTo/x509/x_all.c:47:Â
What's recommended.. Why is it that we are still seeing fails in 24.0.7?
Steven Timm
ÂFrom:ÂHTCondor-users <htcondor-users-bounces@xxxxxxxxxxx> on behalf of Tim Theisen via HTCondor-users <htcondor-users@xxxxxxxxxxx>
Sent:ÂThursday, November 13, 2025 9:10 AM
To:ÂHTCondor-Users Mail List <htcondor-users@xxxxxxxxxxx>
Cc:ÂTimothy Theisen <tim@xxxxxxxxxxx>
Subject:ÂRe: [HTCondor-users] Problems with OpenSSL 3.5.1Â_______________________________________________[EXTERNAL] â This message is from an external senderSlight changes to the first versions with this fix.23.0.24, 23.10.24, 24.0.7, 24.7.3...Tim
On 11/12/25 16:42, Jaime Frey via HTCondor-users wrote:
What version of HTCondor are you running (both on the AP and EP)? We fixed a similar-sounding problem earlier this year:Âhttps://opensciencegrid.atlassian.net/browse/HTCONDOR-2904
The fix went into these versions:23.0.2323.10.2324.0.724.7.0
Â- Jaime
_______________________________________________Hi all,We updated openssl via autoupdates this morning to version 3.5.1 on RHEL9. Since then, no new jobs have started. In the ShadowLog on the CE we found a problem with openssl 3.5.1.
From our ShadowLog
11/12/25 10:57:11 (pid:522121) (D_ALWAYS) (1121027.0) (522111): Delegation error: C067501B957F0000:error:05800091:x509 certificate routines:X509_REQ_verify_ex:unsupported version:crypto/x509/x_all.c:47:Therefore, the proxy delegation does not work, and the proxy file cannot be copied to the WN. I found an issue with openssl that produces the same error message [1]. I'm not sure if this is a new behavior or a bug in the new openssl version. A downgrade to openssl 3.2.2 fixed the problem for us. Our CEs on RHEL8 are not affected since the new openssl version is not available there by default.
11/12/25 10:57:11 (pid:522121) (D_ALWAYS) (1121027.0) (522111): Delegation error:
11/12/25 10:57:11 (pid:522121) (D_ALWAYS) (1121027.0) (522111): ReliSock::put_x509_delegation(): delegation failed: X509Credential::Delegate() failed
11/12/25 10:57:11 (pid:522121) (D_ALWAYS) (1121027.0) (522111): Transfer exit info: Success = False | Error[13.0] = '|Error: sending file /var/lib/condor-ce/spool/4393/29/cluster554393.proc29.subproc0/tmp7ght7u55' | Ack = DOWNLOAD | Line = 5580 | Files
= 0 | Retry = True
11/12/25 10:57:11 (pid:522121) (D_ALWAYS) (1121027.0) (522111): DoUpload: SHADOW at 2a00:139c:a:a:86d2:5ee9:4b76:3e82 failed to send file(s) to <[2a00:139c:9:8::b0]:43045>: |Error: sending file /var/lib/condor-ce/spool/4393/29/cluster554393.proc29.subpr
oc0/tmp7ght7u55; STARTER at 2a00:139c:9:8::b0 - |Error: receiving file /tmp/condor_execute/dir_881536/tmp7ght7u55
11/12/25 10:57:11 (pid:522111) (D_ALWAYS) (1121027.0) (522111): File transfer failed (status=0).
Regards,Matthias
HTCondor-users mailing list
To unsubscribe, send a message toÂhtcondor-users-request@xxxxxxxxxxxwith a
subject: Unsubscribe
The archives can be found at:Âhttps://www-auth.cs.wisc.edu/lists/htcondor-users/
_______________________________________________ HTCondor-users mailing list To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a subject: Unsubscribe The archives can be found at: https://www-auth.cs.wisc.edu/lists/htcondor-users/-- Tim Theisen (he, him, his) Release Manager Center for High Throughput Computing University of Wisconsin - Madison 3695 Morgridge Hall 1205 University Ave Madison, WI 53706
HTCondor-users mailing list
To unsubscribe, send a message toÂhtcondor-users-request@xxxxxxxxxxxÂwith a
subject: Unsubscribe
The archives can be found at:Âhttps://www-auth.cs.wisc.edu/lists/htcondor-users/
_______________________________________________ HTCondor-users mailing list To unsubscribe, send a message to htcondor-users-request@xxxxxxxxxxx with a subject: Unsubscribe The archives can be found at: https://www-auth.cs.wisc.edu/lists/htcondor-users/