elastic Q&A(updating)

elasticsearch

版本7.16.2

java client

java client连接带基础安全ES

  URI uri = ElasticSearchClient.class.getClassLoader().getResource("http.p12").toURI();

  Path trustStorePath = Paths.get(uri);
  KeyStore truststore = KeyStore.getInstance("pkcs12");

  RestClientBuilder builder = null;

  try (InputStream is = Files.newInputStream(trustStorePath)) {
      truststore.load(is, "http123".toCharArray());

      SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
      SSLContext sslContext = sslBuilder.build();

      final CredentialsProvider credentialsProvider =
              new BasicCredentialsProvider();
      credentialsProvider.setCredentials(AuthScope.ANY,
              new UsernamePasswordCredentials("elastic", "password"));

      builder = RestClient.builder(
                      new HttpHost("hostname1", 9200, "https"),
                      new HttpHost("hostname2", 9200, "https"),
                      new HttpHost("hostname3", 9200, "https")
              )
              .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                  @Override
                  public HttpAsyncClientBuilder customizeHttpClient(
                          HttpAsyncClientBuilder httpClientBuilder) {
                      return httpClientBuilder
                              .setSSLContext(sslContext)
                              .setDefaultCredentialsProvider(credentialsProvider);
                  }
              });


  } catch (Exception e) {
      e.printStackTrace();
      throw new RuntimeException(e);
  }
  RestClient client = builder.build();

ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]; nested: ElasticsearchException[failed to initialize SSL TrustManager]; nested: IOException[parseAlgParameters failed: ObjectIdentifier() -- data isn't an object ID (tag = 48)]; nested: IOException[ObjectIdentifier() -- data isn't an object ID (tag = 48)];

是由于ES集群jdk版本与开发jdk版本不同

kibana

配置基础安全kibana时出现hostname和 cert's CN匹配不上问题

[17:58:03.050] [error][elasticsearch-service] Unable to retrieve version information from Elasticsearch nodes. Hostname/IP does not match certificate's altnames: Host: sit-201-128-10-12-20-03. is not cert's CN: SIT-201-128-10-12-20-*

实际上配置文件

...
elasticsearch.hosts: "https://SIT-201-128-10-12-20-03:9200"
...

运行仍出来上边问题.

又测试直接通过命令修改
先注释配置文件中elasticsearch.hosts
再启动命令中传入

 bin/kibana -H SIT-201-128-10-12-20-03 -e 'https://SIT-201-128-10-12-20-03:9200'

结果仍出来如上错误. 实际上和在配置trino安全认证时遇到的类似问题一样,在生成CA相关操作时相关的hostname一定要小写,不然就会出现这样问题