在测试环境里,Hive DB搭建在Ambari统一管理的环境里,Knox提供gateway功能。
某日,Knox服务启动失败,查看log报错如下:
2022-06-08 20:40:07,992 INFO knox.gateway (JettySSLService.java:logAndValidateCertificate(112)) - The Gateway SSL certificate is issued to hostname: server.test.com.
2022-06-08 20:40:07,993 INFO knox.gateway (JettySSLService.java:logAndValidateCertificate(115)) - The Gateway SSL certificate is valid between: 6/4/21 8:53 AM and 6/4/22 8:53 AM.
2022-06-08 20:40:07,998 FATAL knox.gateway (GatewayServer.java:main(175)) - Failed to start gateway: org.apache.knox.gateway.services.ServiceLifecycleException: Gateway SSL Certificate is Expired. Server will not start.
SSL certificate过期了,这个问题Google一下就找到解决方法了。详情参考这篇IBM technote。
[root@server ~]# ll /var/lib/knox/data*/security/keystores/gateway.jks
-rw-r--r-- 1 knox knox 1379 Jun 4 2021 /var/lib/knox/data-3.1.5.0-152/security/keystores/gateway.jks
[root@server ~]# mv /var/lib/knox/data*/security/keystores/gateway.jks /tmp/gateway.jks
然后重启Knox服务以及Knox里头的LDAP服务就自动生成新的certificate了,Knox成功启动。
但是,当client端要连过来Hive DB的话,需要使用新的SSL certificate。这里可以使用下面的命令来从gateway.jks文件中读取SSL certificate。
keytool -list -rfc -keystore gateway.jks