Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect

本文探讨了在启动YARN上的Flink会话时遇到的SSL初始化失败问题,详细分析了错误堆栈,指出问题源于密钥库被篡改或密码设置不当,并提供了解决方案。

启动yarn-session时上报的错误
java.io.IOException: Failed to initialize SSLContext for the blob server
at org.apache.flink.runtime.blob.BlobServer.(BlobServer.java:201)
at org.apache.flink.runtime.jobmanager.JobManager.createJobManagerComponents(JobManager.scala:2496)atorg.apache.flink.runtime.jobmanager.JobManager.createJobManagerComponents(JobManager.scala:2496) at org.apache.flink.runtime.jobmanager.JobManager.createJobManagerComponents(JobManager.scala:2496)atorg.apache.flink.runtime.jobmanager.JobManager.startJobManagerActors(JobManager.scala:2638)
at org.apache.flink.runtime.jobmanager.JobManager.startJobManagerActors(JobManager.scala)
at org.apache.flink.yarn.YarnApplicationMasterRunner.runApplicationMaster(YarnApplicationMasterRunner.java:375)
at org.apache.flink.yarn.YarnApplicationMasterRunner$1.call(YarnApplicationMasterRunner.java:195)
at org.apache.flink.yarn.YarnApplicationMasterRunner1.call(YarnApplicationMasterRunner.java:192)atjava.security.AccessController.doPrivileged(NativeMethod)atjavax.security.auth.Subject.doAs(Subject.java:422)atorg.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1729)atorg.apache.flink.runtime.security.HadoopSecurityContext.runSecured(HadoopSecurityContext.java:41)atorg.apache.flink.yarn.YarnApplicationMasterRunner.run(YarnApplicationMasterRunner.java:192)atorg.apache.flink.yarn.YarnApplicationMasterRunner.main(YarnApplicationMasterRunner.java:125)Causedby:java.io.IOException:Keystorewastamperedwith,orpasswordwasincorrectatsun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:785)atsun.security.provider.JavaKeyStore1.call(YarnApplicationMasterRunner.java:192) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:422) at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1729) at org.apache.flink.runtime.security.HadoopSecurityContext.runSecured(HadoopSecurityContext.java:41) at org.apache.flink.yarn.YarnApplicationMasterRunner.run(YarnApplicationMasterRunner.java:192) at org.apache.flink.yarn.YarnApplicationMasterRunner.main(YarnApplicationMasterRunner.java:125) Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:785) at sun.security.provider.JavaKeyStore1.call(YarnApplicationMasterRunner.java:192)atjava.security.AccessController.doPrivileged(NativeMethod)atjavax.security.auth.Subject.doAs(Subject.java:422)atorg.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1729)atorg.apache.flink.runtime.security.HadoopSecurityContext.runSecured(HadoopSecurityContext.java:41)atorg.apache.flink.yarn.YarnApplicationMasterRunner.run(YarnApplicationMasterRunner.java:192)atorg.apache.flink.yarn.YarnApplicationMasterRunner.main(YarnApplicationMasterRunner.java:125)Causedby:java.io.IOException:Keystorewastamperedwith,orpasswordwasincorrectatsun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:785)atsun.security.provider.JavaKeyStoreJKS.engineLoad(JavaKeyStore.java:56)
at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)
at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)
at java.security.KeyStore.load(KeyStore.java:1445)
at org.apache.flink.runtime.net.SSLUtils.createSSLServerContext(SSLUtils.java:197)
at org.apache.flink.runtime.blob.BlobServer.(BlobServer.java:199)
… 12 common frames omitted
Caused by: java.security.UnrecoverableKeyException: Password verification failed
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:783)
解决方法:
密码设置的不符合规则,导致SSL无法解析,修改密码

在配置Spring Boot应用的SSL时遇到 `java.io.IOException: Invalid keystore format` 异常,通常与密钥库(keystore)文件的格式或生成它的JDK版本不兼容有关。以下是几种可能的原因及对应的解决方案: ### 1. 密钥库格式与JDK版本不兼容 如果使用较高版本的JDK(如JDK 11或以上)生成了密钥库(keystore),而在较低版本的JDK(如JDK 8)中运行Spring Boot应用,则可能导致该异常。这是因为不同JDK版本对密钥库的支持格式有所差异。 **解决方法:** - 确保用于生成密钥库的JDK版本与运行Spring Boot应用所使用的JDK版本一致或更低。 - 如果需要在旧版本JDK上运行,可以尝试使用该旧版本JDK重新生成密钥库文件[^2]。 ### 2. 密钥库文件损坏或格式错误 如果密钥库文件本身已损坏、未正确生成,或者不是标准的JKS(Java KeyStore)格式,也可能导致此问题。 **解决方法:** - 使用以下命令重新生成一个标准的JKS文件: ```bash keytool -genkeypair -alias mydomain -keyalg RSA -keysize 2048 -validity 365 -keystore your_keystore.jks ``` 在执行上述命令时,请确保环境变量中已正确配置了JDK路径,并且使用的是与目标运行环境一致的JDK版本[^3]。 ### 3. Spring Boot项目中引用了错误的密钥库路径或密码 即使密钥库本身没有问题,但如果Spring Boot项目的配置文件(如`application.properties`或`application.yml`)中指定了错误的密钥库路径、密码或别名,也会导致加载失败并抛出`Invalid keystore format`异常。 **解决方法:** - 检查`application.properties`或`application.yml`中的SSL配置是否正确,例如: ```properties server.port=8443 server.ssl.key-store=classpath:your_keystore.jks server.ssl.key-store-password=your_password server.ssl.key-store-type=JKS server.ssl.key-alias=mydomain ``` ### 4. 使用非标准工具生成的密钥库 有时,使用第三方工具或OpenSSL生成的密钥库可能不符合Java标准格式(如PEM格式),而Spring Boot默认期望的是JKS格式的密钥库。 **解决方法:** - 将PEM格式的证书和私钥转换为PKCS#12格式,再导入到JKS中: ```bash openssl pkcs12 -export -out certificate.pfx -inkey private_key.pem -in certificate.crt keytool -importkeystore -deststorepass your_password -destkeypass your_password -destkeystore your_keystore.jks -srckeystore certificate.pfx -srcstoretype PKCS12 -srcstorepass your_password ``` ### 示例:完整的Spring Boot SSL配置代码片段 ```yaml server: port: 8443 ssl: key-store: classpath:your_keystore.jks key-store-password: your_password key-store-type: JKS key-alias: mydomain ``` ###
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值