Tech note: HTTPS connector fails after upgrading to version 1.80.16🔗

Long-standing Matillion ETL instances that have been upgraded many times might fail to accept HTTPS connections after an in-place upgrade to version 1.80.16. This tech note explains why this happens and how to restore access.

Applies to🔗

Matillion ETL instances that meet both of these conditions:

The instance has the tomcat-native package installed. This is the case for instances that run on CentOS Stream 9, including long-standing instances that have been upgraded in place many times.
The instance is upgraded in place to version 1.80.16.

Instances created from the openSUSE base image don't install the tomcat-native plugin and aren't affected.

This issue only applies to version 1.80.16.

Symptoms🔗

After an in-place upgrade to version 1.80.16, you can't connect to your Matillion ETL instance over HTTPS. The Tomcat HTTPS connector (https-openssl-nio2-8443) fails to initialize, although Tomcat itself starts and HTTP on port 8080 continues to work.

If a load balancer fronts your instance, you might see 502 errors, and the instance appears as unhealthy in the load balancer target group.

The Tomcat startup log contains a message similar to the following:

Apache Tomcat Native library [1.3.9] is installed, while Tomcat recommends a minimum version of [2.0.15]

The log also contains a java.lang.ExceptionInInitializerError caused by java.lang.NullPointerException: ByteBuffer is null or not direct.

Root cause🔗

The tomcat-native plugin was installed on Matillion ETL instances running CentOS Stream 9. The plugin was intended to improve SSL performance by offloading encryption work from Java to the operating system libraries. Because of performance improvements in Java, the plugin is no longer recommended or required.

The version of the tomcat-native library installed on these instances is out of date and is incompatible with newer versions of Tomcat. Matillion ETL requires the newer Tomcat versions to receive security updates for that package.

Matillion has removed the installation of the plugin from new openSUSE-based images. However, operating system packages can't be removed while the Matillion ETL package is being updated, so the plugin remains on upgraded instances and you must remove it manually.

What do you need to do?🔗

If you can't connect to your Matillion ETL instance over HTTPS after an upgrade, remove the tomcat-native package and restart Tomcat:

SSH into the Matillion ETL instance with root access.
Run the following command to remove the tomcat-native package:
```
yum remove --assumeyes tomcat-native
```
Run the following command to restart Tomcat:
```
systemctl restart tomcat
```

HTTPS access to your Matillion ETL instance is now restored.

For more information about the Tomcat version used by Matillion ETL, see Upgrade Tomcat version.

For more information about the operating system change, see Tech note - Base OS change to openSUSE.