SSL上带弹性搜索的千分尺

Question

我正在尝试使用SSL上带有Elasticsearch的测微计。

我在版本1.8.0中使用测微计，在版本7.16.3和OpenJDK 11.0.2中使用Elasticsearch。

因为我知道不可能使用内置配置(链接),所以我尝试注入一个自定义的HttpUrlConnectionSender，如下面的SecureHttpSender类所示:

public class SecureHttpSender extends HttpUrlConnectionSender {
    ...

    public SecureHttpSender(ElasticProperties properties, SecureElasticProperties secureElasticProperties) {
                super(properties.getConnectTimeout(), properties.getReadTimeout());
                this.secureElasticProperties = secureElasticProperties;
                this.sslSocketFactory = buildSslSocketFactory();
            }
    
    @Override
    public Response send(Request request) throws IOException {
        HttpURLConnection httpURLConnection = null;
        try {
            httpURLConnection = (HttpURLConnection) request.getUrl().openConnection();
    
            // if the connection is an instance of the HttpsURLConnection class, the ssl configuration will always been applied.
            if (httpURLConnection instanceof HttpsURLConnection) {
                // - hostname verifier
                if (!secureElasticProperties.isVerifyHostname()) {
                    logger.debug("setting the hostname verifier to: {}", NoopHostnameVerifier.INSTANCE);
                    ((HttpsURLConnection) httpURLConnection).setHostnameVerifier(NoopHostnameVerifier.INSTANCE);
                }
    
                // - trust store configuration
                ((HttpsURLConnection) httpURLConnection).setSSLSocketFactory(sslSocketFactory);
            }
    
            return super.send(request);
    
        } finally {
            try {
                if (httpURLConnection != null) {
                    httpURLConnection.disconnect();
                }
            } catch (Exception ignore) {
            }
        }
    }
    
    private SSLSocketFactory buildSslSocketFactory() {
        SSLSocketFactory sslSocketFactory;
        try (InputStream is = getInputStream(secureElasticProperties.getTrustStorePath())) {
            KeyStore truststore = KeyStore.getInstance(secureElasticProperties.getTrustStoreType());
            truststore.load(is, secureElasticProperties.getTrustStorePassword().toCharArray());
            SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
            final SSLContext sslContext = sslBuilder.build();
            sslSocketFactory = sslContext.getSocketFactory();
        } catch (IOException | CertificateException | KeyStoreException | NoSuchAlgorithmException | KeyManagementException e) {
            String message = String.format("error while loading the security configuration from: %s", secureElasticProperties);
            logger.error(message, e);
            throw new RuntimeException("management.metrics.export.elastic.ssl");
        }
        return sslSocketFactory;
    }
    
    private InputStream getInputStream(String trustStorePathString) throws IOException {
    PathMatchingResourcePatternResolver pathMatchingResourcePatternResolver = new PathMatchingResourcePatternResolver();
    Resource resource = pathMatchingResourcePatternResolver.getResource(trustStorePathString);
    return resource.getInputStream();
    }
}

我注入了Spring启动，所以我可以应用所需的配置，但我得到以下错误：

ERROR 10912 --- [trics-publisher] i.m.elastic.ElasticMeterRegistry         : failed to send metrics to elastic
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

服务器证书和客户端信任库是有效的，因为我已经成功地使用了它们。我还尝试在握手阶段强制使用特定版本的TLS协议：TLSv1.3和TLSv1.2，但错误仍然发生。

有人对如何修复它有什么建议吗？谢谢

Answer 1

我对我发布的代码做了一个简单的更改，并解决了它:我复制了super.send()方法的所有代码，添加了额外的代码来设置自定义的SslSocketFactory，一切正常！

原因是

它将创建一个新连接，而不使用您创建的连接

正如Jonatan所说…一个我微不足道的错误。：）

Answer 2

检查super.send的作用，它会创建一个新连接，而不使用您创建的连接。我不建议使用自签名证书和自定义信任库，但您可以使用HttpsURLConnection.setDefaultHostnameVerifier设置默认的HostnameVerifier。

由于这是静态的，它将适用于所有 HttpsURL 连接实例，因此您无需向千分尺注入任何内容。

正确的解决方案是使用非自签名证书或适当的信任库（例如：通过 javax.net.ssl.trustStore）。