elasticsearch证书过期进行更换

YXWik6

已于 2025-06-17 10:10:49 修改

阅读量240

点赞数 1

CC 4.0 BY-SA版权

分类专栏： Elasticsearch java 文章标签： elasticsearch java

于 2025-06-17 10:10:31 首次发布

本文链接：https://blog.youkuaiyun.com/YXWik/article/details/148709135

java 同时被 2 个专栏收录

27 篇文章

订阅专栏

Elasticsearch

3 篇文章

订阅专栏

es配置文件

xpack.security.enabled: true
xpack.security.enrollment.enabled: true
cluster.initial_master_nodes: ["iZ8vb6tda6e8mwssfo6usfZ"]
http.host: 0.0.0.0
path:
  data: /usr/sftp/file/es-data  #数据路径
  logs: /usr/sftp/file/es-data/logs   #日志路径


# ====== CERT FIX START (自动生成于 2025年 06月 17日 星期二 09:32:38 CST) ======
# 传输层SSL配置
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elasticsearch-cert.p12
  truststore.path: certs/truststore.jks
  keystore.type: PKCS12
  truststore.type: JKS
  truststore.password: changeit
# HTTP层SSL配置
xpack.security.http.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elasticsearch-cert.p12
  truststore.path: certs/truststore.jks
  keystore.type: PKCS12
  truststore.type: JKS
  truststore.password: changeit
# ====== CERT FIX END ======

一键生成脚本

#!/bin/bash

# =============================================================================
# Elasticsearch 单机版 SSL 证书修复工具 (适用于 OpenSSL 1.0)
# 版本：3.4 | 日期：2025-06-17
# ============================================================================= 

# --------------------------------------
# 颜色输出函数（必须放在最前）
# --------------------------------------
function status_msg() { echo -e "\e[1;32m[✓] $1\e[0m"; }
function warning_msg() { echo -e "\e[1;33m[!] $1\e[0m"; }
function error_msg() { echo -e "\e[1;31m[✗] $1\e[0m"; exit 1; }

# --------------------------------------
# 配置区域（根据实际环境修改）
# --------------------------------------
ES_HOME="/home/3goodsoft/elasticsearch/elasticsearch-8.8.0"
CERT_DIR="${ES_HOME}/config/certs"
ES_USER="elastic"  # 运行Elasticsearch的用户 
KEYSTORE_PASS="changeit"

# --------------------------------------
# 环境验证
# --------------------------------------
function validate_environment() {
    if [[ $EUID -ne 0 ]]; then
        warning_msg "建议使用 sudo 运行此脚本"
    fi
    
    OPENSSL_VERSION=$(openssl version | awk '{print $2}')
    if [[ "$OPENSSL_VERSION" != "1.0."* ]]; then
        warning_msg "当前OpenSSL版本为$OPENSSL_VERSION，本脚本针对OpenSSL 1.0.x进行了优化"
    fi 
    
    if [[ ! -d "$CERT_DIR" ]]; then 
        status_msg "创建证书目录: $CERT_DIR"
        mkdir -p "$CERT_DIR"
    fi 

    if ! command -v keytool &>/dev/null; then
        error_msg "未找到 keytool，请先安装 JDK（如 OpenJDK 11+）"
    fi

    JAVA_VERSION=$(java -version 2>&1 | grep version | awk '{print $3}' | tr -d '"')
    if (( $(echo "$JAVA_VERSION < 11" | bc -l) )); then
        warning_msg "当前 Java 版本为 $JAVA_VERSION，建议升级到 JDK 11+"
    fi
}

# --------------------------------------
# 重建证书体系（兼容OpenSSL 1.0）
# --------------------------------------
function rebuild_certificates() {
    echo "▬▬▬▬▬▬▬▬▬ 重建证书体系 ▬▬▬▬▬▬▬▬▬"
    cd "$CERT_DIR" || error_msg "无法进入证书目录"

    # 清理旧文件
    rm -f truststore.jks elasticsearch-cert.p12 http.crt http.key http.csr ca.crt ca.key *.tar.gz

    # 获取主机名和IP地址
    HOST_IP=$(hostname -I | awk '{print $1}')
    HOST_NAME=$(hostname)

    # 生成CA证书
    openssl req -new -x509 -days 3650 -nodes \
      -out ca.crt -keyout ca.key \
      -subj "/C=CN/ST=Shanghai/L=Shanghai/O=3GoodSoft/OU=IT/CN=ES-Root-CA"

    # 创建CSR请求文件
    cat > csr.conf <<-EOF
[req]
default_bits = 4096
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn

[ dn ]
C=CN
ST=Shanghai
L=Shanghai
O=3GoodSoft
OU=IT
CN=$HOST_NAME

[ req_ext ]
subjectAltName = @alt_names

[ alt_names ]
DNS.1 = localhost
DNS.2 = $HOST_NAME
IP.1 = 127.0.0.1
IP.2 = $HOST_IP
EOF

    # 生成私钥和CSR
    openssl req -new -sha256 -nodes -out http.csr -newkey rsa:4096 -keyout http.key \
      -config <(cat csr.conf) -extensions req_ext

    # 签署证书
    openssl x509 -req -in http.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
      -out http.crt -days 3650 -extfile <(grep -A 10 '
$$
 req_ext 
$$
' csr.conf) -extensions req_ext

    # 构建PKCS12 keystore（含服务证书+私钥）
    openssl pkcs12 -export -in http.crt -inkey http.key -name "elasticsearch" \
      -out elasticsearch-cert.p12 -passout pass:

    # 构建JKS truststore（更稳定）
    keytool -importcert -alias root-ca -file ca.crt -keystore truststore.jks \
      -storepass "$KEYSTORE_PASS" -noprompt || error_msg "导入证书到 truststore.jks 失败"

    # 清理临时文件
    rm -f http.csr csr.conf

    status_msg "证书体系重建完成"
}

# --------------------------------------
# 更新Elasticsearch配置
# --------------------------------------
function update_es_config() {
    echo "▬▬▬▬▬▬▬▬▬ 更新配置 ▬▬▬▬▬▬▬▬▬"
    local ES_CONF="${ES_HOME}/config/elasticsearch.yml"

    # 备份原始配置
    cp "$ES_CONF" "${ES_CONF}.backup_$(date +%s)"

    # 删除已有的 CERT FIX 段落
    if grep -q "# ====== CERT FIX START" "$ES_CONF"; then
        sed -i '/# ====== CERT FIX START/,/# ====== CERT FIX END/d' "$ES_CONF"
        status_msg "旧的 CERT FIX 配置已清除"
    fi

    # 写入新配置（使用 JKS）
    cat >> "$ES_CONF" <<-EOF
# ====== CERT FIX START (自动生成于 $(date)) ======
# 传输层SSL配置
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elasticsearch-cert.p12
  truststore.path: certs/truststore.jks
  keystore.type: PKCS12
  truststore.type: JKS
  truststore.password: $KEYSTORE_PASS
# HTTP层SSL配置
xpack.security.http.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/elasticsearch-cert.p12
  truststore.path: certs/truststore.jks
  keystore.type: PKCS12
  truststore.type: JKS
  truststore.password: $KEYSTORE_PASS
# ====== CERT FIX END ======
EOF
    status_msg "配置更新完成"
}

# --------------------------------------
# 权限修复
# --------------------------------------
function reset_keystore_and_permissions() {
    echo "▬▬▬▬▬▬▬▬▬ 密钥库与权限 ▬▬▬▬▬▬▬▬▬"
    
    chown -R "$ES_USER":"$ES_USER" "$CERT_DIR"
    chmod 600 "$CERT_DIR"/*.p12 2>/dev/null
    chmod 600 "$CERT_DIR"/*.jks 2>/dev/null

    status_msg "权限修复完成"
}

# --------------------------------------
# 验证修复结果
# --------------------------------------
function verify_fix() {
    echo "▬▬▬▬▬▬▬▬▬ 验证修复 ▬▬▬▬▬▬▬▬▬"
    
    local TRUST_COUNT=$(keytool -list -keystore truststore.jks -storepass "$KEYSTORE_PASS" 2>/dev/null | grep -c 'root-ca')
    (( TRUST_COUNT >= 1 )) && status_msg "truststore 包含 root-ca 证书" || error_msg "信任库异常"

    echo -e "\n\e[1;33m[!] 请手动启动Elasticsearch：\e[0m"
    echo "  sudo -u $ES_USER ${ES_HOME}/bin/elasticsearch"
    echo -e "\n\e[1;33m[!] 验证命令：\e[0m"
    echo "  curl --cacert $CERT_DIR/ca.crt https://localhost:9200/_cluster/health"
}

# --------------------------------------
# 主程序执行流程
# --------------------------------------
clear 
echo -e "\e[1;36m"
echo "==================================================="
echo " Elasticsearch SSL 证书修复工具 v3.4"
echo " 日期：2025-06-17 | 时间：09:00"
echo "==================================================="
echo -e "\e[0m"

validate_environment
rebuild_certificates
update_es_config
reset_keystore_and_permissions
verify_fix
echo -e "\n\e[42m\e[1;37m 修复流程已完成！请检查Elasticsearch日志 \e[0m"
echo -e "日志路径：\e[1;34m$ES_HOME/logs/elasticsearch.log\e[0m"