elastic Q&A(updating)

最新推荐文章于 2025-09-17 14:39:14 发布

原创最新推荐文章于 2025-09-17 14:39:14 发布 · 2.7k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#elasticsearch #大数据 #big data

bigdata 同时被 2 个专栏收录

60 篇文章

订阅专栏

database

23 篇文章

订阅专栏

本文档详细介绍了在使用 Elasticsearch Java 客户端连接7.16.2版本的ES集群时遇到的安全异常，问题根源在于JDK版本不匹配。同时，针对Kibana配置基础安全时，主机名与证书CN不匹配的问题进行了分析，指出解决方案在于确保hostname全小写。配置过程中涉及SSL上下文、信任材料、凭证提供者等关键步骤。

elasticsearch

版本7.16.2

java client

java client连接带基础安全ES

  URI uri = ElasticSearchClient.class.getClassLoader().getResource("http.p12").toURI();

  Path trustStorePath = Paths.get(uri);
  KeyStore truststore = KeyStore.getInstance("pkcs12");

  RestClientBuilder builder = null;

  try (InputStream is = Files.newInputStream(trustStorePath)) {
      truststore.load(is, "http123".toCharArray());

      SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
      SSLContext sslContext = sslBuilder.build();

      final CredentialsProvider credentialsProvider =
              new BasicCredentialsProvider();
      credentialsProvider.setCredentials(AuthScope.ANY,
              new UsernamePasswordCredentials("elastic", "password"));

      builder = RestClient.builder(
                      new HttpHost("hostname1", 9200, "https"),
                      new HttpHost("hostname2", 9200, "https"),
                      new HttpHost("hostname3", 9200, "https")
              )
              .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                  @Override
                  public HttpAsyncClientBuilder customizeHttpClient(
                          HttpAsyncClientBuilder httpClientBuilder) {
                      return httpClientBuilder
                              .setSSLContext(sslContext)
                              .setDefaultCredentialsProvider(credentialsProvider);
                  }
              });


  } catch (Exception e) {
      e.printStackTrace();
      throw new RuntimeException(e);
  }
  RestClient client = builder.build();

ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]; nested: ElasticsearchException[failed to initialize SSL TrustManager]; nested: IOException[parseAlgParameters failed: ObjectIdentifier() -- data isn't an object ID (tag = 48)]; nested: IOException[ObjectIdentifier() -- data isn't an object ID (tag = 48)];

是由于ES集群jdk版本与开发jdk版本不同

kibana

配置基础安全kibana时出现hostname和 cert's CN匹配不上问题

[17:58:03.050] [error][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. Hostname/IP does not match certificate's altnames: Host: sit-201-128-10-12-20-03. is not cert's CN: SIT-201-128-10-12-20-*

实际上配置文件

...
elasticsearch.hosts: "https://SIT-201-128-10-12-20-03:9200"
...

运行仍出来上边问题.

又测试直接通过命令修改
先注释配置文件中elasticsearch.hosts
再启动命令中传入

 bin/kibana -H SIT-201-128-10-12-20-03 -e 'https://SIT-201-128-10-12-20-03:9200'

结果仍出来如上错误. 实际上和在配置trino安全认证时遇到的类似问题一样,在生成CA相关操作时相关的hostname一定要小写,不然就会出现这样问题