openssl, iptables issue.

[해리]

the issue happened because the 443 port was rejected on iptables service of Redhat.

 ================================================================
[root@muaquorumcp bin]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:5634
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@muaquorumcp bin]#
 ================================================================

 After stop the iptables service, the cluster nodes and CP Server could communicate through 443 port. 
 ================================================================
[root@muaquorumcp init.d]# ./iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]
[root@muaquorumcp init.d]# ./iptables stop
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
[root@muaquorumcp init.d]#
 ================================================================

 One more thing is that the iptables service will start if the server is restarted. 

 So, please disable iptables service using the below command to prevent starting when server boot or ask O/S vendor to make accepting 443 port connection. 
 ================================================================
 # chkconfig iptables off
​ ================================================================

 Or (please check with O/S vendor)
​ ================================================================
 # /etc/init.d/iptables start
 # /etc/init.d/iptables -A INPUT -p tcp -m tcp --sport 443 -j ACCEPT
 # /etc/init.d/iptables -A OUTPUT -p tcp -m tcp --dport 443 -j ACCEPT
 # /etc/init.d/iptables save
​ ================================================================

  => And then, check whether openssl works from VCS node to CP server.
​ ================================================================
# openssl s_client -connect 10.77.103.173:443 -ssl3
​ ================================================================

CPS test.

cpsadm -s cp_server -a list_membership -c cluster_name
/opt/VRTS/bin/cpsadm -s cp_server -a ping_cps