zmtrainsa not working after upgrade

[MrMEEE]

After upgrading from 8.x to 9.0, zmtrainsa has stopped working:

[zimbra@jarjar ~]$ zmtrainsa
20220302183033 Starting spam/ham extraction from system accounts.
Exception in thread "main" com.zimbra.common.service.ServiceException: system failure: admin auth failed url=https://jarjar.outerrim.lan:7071/service/admin/soap/
ExceptionId:main:1646242234778:270fae5ec188cb83
Code:service.FAILURE
at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:288)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(SpamExtract.java:566)
at com.zimbra.cs.util.SpamExtract.main(SpamExtract.java:218)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:285)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:184)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1460)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1368)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:437)
at com.zimbra.common.net.CustomSSLSocket.startHandshake(CustomSSLSocket.java:95)
at com.zimbra.common.net.CustomSSLSocket.getInputStream(CustomSSLSocket.java:360)
at org.apache.http.impl.BHttpConnectionBase.getSocketInputStream(BHttpConnectionBase.java:141)
at org.apache.http.impl.conn.LoggingManagedHttpClientConnection.getSocketInputStream(LoggingManagedHttpClientConnection.java:103)
at org.apache.http.impl.BHttpConnectionBase.ensureOpen(BHttpConnectionBase.java:133)
at org.apache.http.impl.DefaultBHttpClientConnection.sendRequestHeader(DefaultBHttpClientConnection.java:140)
at org.apache.http.impl.conn.CPoolProxy.sendRequestHeader(CPoolProxy.java:147)
at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:205)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:123)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:272)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:321)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:196)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:189)
at com.zimbra.common.soap.SoapTransport.invoke(SoapTransport.java:447)
at com.zimbra.common.soap.SoapTransport.invokeWithoutSession(SoapTransport.java:432)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(SpamExtract.java:561)
... 1 more
Exception in thread "main" com.zimbra.common.service.ServiceException: system failure: admin auth failed url=https://jarjar.outerrim.lan:7071/service/admin/soap/
ExceptionId:main:1646242235822:f335adee7eee614f
Code:service.FAILURE
at com.zimbra.common.service.ServiceException.FAILURE(ServiceException.java:288)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(SpamExtract.java:566)
at com.zimbra.cs.util.SpamExtract.main(SpamExtract.java:218)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:285)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:184)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1460)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1368)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:437)
at com.zimbra.common.net.CustomSSLSocket.startHandshake(CustomSSLSocket.java:95)
at com.zimbra.common.net.CustomSSLSocket.getInputStream(CustomSSLSocket.java:360)
at org.apache.http.impl.BHttpConnectionBase.getSocketInputStream(BHttpConnectionBase.java:141)
at org.apache.http.impl.conn.LoggingManagedHttpClientConnection.getSocketInputStream(LoggingManagedHttpClientConnection.java:103)
at org.apache.http.impl.BHttpConnectionBase.ensureOpen(BHttpConnectionBase.java:133)
at org.apache.http.impl.DefaultBHttpClientConnection.sendRequestHeader(DefaultBHttpClientConnection.java:140)
at org.apache.http.impl.conn.CPoolProxy.sendRequestHeader(CPoolProxy.java:147)
at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:205)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:123)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:272)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:321)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:196)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:189)
at com.zimbra.common.soap.SoapTransport.invoke(SoapTransport.java:447)
at com.zimbra.common.soap.SoapTransport.invokeWithoutSession(SoapTransport.java:432)
at com.zimbra.cs.util.SpamExtract.getAdminAuthToken(SpamExtract.java:561)
... 1 more
20220302183035 Finished extracting spam/ham from system accounts.
20220302183035 Starting spamassassin training.
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been included
Learned tokens from 0 message(s) (0 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been included
Learned tokens from 0 message(s) (0 message(s) examined)
netset: cannot include 127.0.0.0/8 as it has already been included
netset: cannot include 0:0:0:0:0:0:0:1/128 as it has already been included
20220302183037 Finished spamassassin training.

Openssl fails as well:

[zimbra@jarjar ~]$ openssl s_client -connect jarjar.outerrim.lan:7071
CONNECTED(00000003)
140661467427328:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:ssl/record/rec_layer_s3.c:1544:SSL alert number 40

no peer certificate available

No client certificate CA names sent

SSL handshake has read 7 bytes and written 321 bytes
Verification: OK

New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

I have also tried using the proxied port:

[zimbra@jarjar ~]$ /opt/zimbra/libexec/zmspamextract -u https://jarjar.outerrim.lan:9071/service/admin/soap/ -o /tmp/test -s
Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:285)
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:184)
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164)
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1460)
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1368)
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:437)
at com.zimbra.common.net.CustomSSLSocket.startHandshake(CustomSSLSocket.java:95)
at com.zimbra.common.net.CustomSSLSocket.getInputStream(CustomSSLSocket.java:360)
at org.apache.http.impl.BHttpConnectionBase.getSocketInputStream(BHttpConnectionBase.java:141)
at org.apache.http.impl.conn.LoggingManagedHttpClientConnection.getSocketInputStream(LoggingManagedHttpClientConnection.java:103)
at org.apache.http.impl.BHttpConnectionBase.ensureOpen(BHttpConnectionBase.java:133)
at org.apache.http.impl.DefaultBHttpClientConnection.sendRequestHeader(DefaultBHttpClientConnection.java:140)
at org.apache.http.impl.conn.CPoolProxy.sendRequestHeader(CPoolProxy.java:147)
at org.apache.http.protocol.HttpRequestExecutor.doSendRequest(HttpRequestExecutor.java:205)
at org.apache.http.protocol.HttpRequestExecutor.execute(HttpRequestExecutor.java:123)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:272)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:321)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:196)
at com.zimbra.common.soap.SoapHttpTransport.invoke(SoapHttpTransport.java:189)
at com.zimbra.common.soap.SoapTransport.invoke(SoapTransport.java:447)
at com.zimbra.cs.util.SpamExtract.extract(SpamExtract.java:271)
at com.zimbra.cs.util.SpamExtract.main(SpamExtract.java:222)

Still the same issue...

zmprov works..

How do I fix zmtrainsa?

Thanks