Micrometer 与基于 SSL 的 Elasticsearch

Question

我正在尝试将 Micrometer 与基于 SSL 的 Elasticsearch 结合使用。

我使用 Micrometer 版本 1.8.0、Elasticsearch 版本 7.16.3 和 OpenJDK 11.0.2 。

因为我知道不可能使用内置配置（链接 ）我尝试注入一个自定义的 HttpUrlConnectionSender ，如以下类 SecureHttpSender 中所示：

public class SecureHttpSender extends HttpUrlConnectionSender {
    ...

    public SecureHttpSender(ElasticProperties properties, SecureElasticProperties secureElasticProperties) {
                super(properties.getConnectTimeout(), properties.getReadTimeout());
                this.secureElasticProperties = secureElasticProperties;
                this.sslSocketFactory = buildSslSocketFactory();
            }
    
    @Override
    public Response send(Request request) throws IOException {
        HttpURLConnection httpURLConnection = null;
        try {
            httpURLConnection = (HttpURLConnection) request.getUrl().openConnection();
    
            // if the connection is an instance of the HttpsURLConnection class, the ssl configuration will always been applied.
            if (httpURLConnection instanceof HttpsURLConnection) {
                // - hostname verifier
                if (!secureElasticProperties.isVerifyHostname()) {
                    logger.debug("setting the hostname verifier to: {}", NoopHostnameVerifier.INSTANCE);
                    ((HttpsURLConnection) httpURLConnection).setHostnameVerifier(NoopHostnameVerifier.INSTANCE);
                }
    
                // - trust store configuration
                ((HttpsURLConnection) httpURLConnection).setSSLSocketFactory(sslSocketFactory);
            }
    
            return super.send(request);
    
        } finally {
            try {
                if (httpURLConnection != null) {
                    httpURLConnection.disconnect();
                }
            } catch (Exception ignore) {
            }
        }
    }
    
    private SSLSocketFactory buildSslSocketFactory() {
        SSLSocketFactory sslSocketFactory;
        try (InputStream is = getInputStream(secureElasticProperties.getTrustStorePath())) {
            KeyStore truststore = KeyStore.getInstance(secureElasticProperties.getTrustStoreType());
            truststore.load(is, secureElasticProperties.getTrustStorePassword().toCharArray());
            SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
            final SSLContext sslContext = sslBuilder.build();
            sslSocketFactory = sslContext.getSocketFactory();
        } catch (IOException | CertificateException | KeyStoreException | NoSuchAlgorithmException | KeyManagementException e) {
            String message = String.format("error while loading the security configuration from: %s", secureElasticProperties);
            logger.error(message, e);
            throw new RuntimeException("management.metrics.export.elastic.ssl");
        }
        return sslSocketFactory;
    }
    
    private InputStream getInputStream(String trustStorePathString) throws IOException {
    PathMatchingResourcePatternResolver pathMatchingResourcePatternResolver = new PathMatchingResourcePatternResolver();
    Resource resource = pathMatchingResourcePatternResolver.getResource(trustStorePathString);
    return resource.getInputStream();
    }
}

我用 Spring Boot 注入了该类，以便我可以应用所需的配置，但出现以下错误：

ERROR 10912 --- [trics-publisher] i.m.elastic.ElasticMeterRegistry         : failed to send metrics to elastic
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
...

服务器证书和客户端信任库是有效的，因为我已经成功使用它们。 我还尝试在握手阶段强制使用特定版本的 TLS 协议：TLSv1.3 和 TLSv1.2，但错误仍然发生。

有人对如何修复它有任何建议吗？谢谢

Answer 1

检查 super.send 的作用，它会创建一个新连接，而不使用您创建的连接。我不建议使用自签名证书和自定义信任库，但您可以使用设置默认的 HostnameVerifier
HttpsURLConnection.setDefaultHostnameVerifier。

由于这是静态的，因此它将适用于所有 HttpsURLConnection 实例，因此您无需向 Micrometer 中注入任何内容。

正确的解决方案是使用非自签名证书或适当的信任库（例如：通过 javax.net.ssl.trustStore）。

Answer 2

我做了一个测试，对我发布的代码进行了简单的更改，并解决了它：
我复制了 super.send() 方法的所有代码，添加了额外的代码来设置自定义 SslSocketFactory ，一切正常！

所以原因是

它会创建一个新连接，而不使用您创建的连接

正如乔纳坦所说......这是我的一个小错误。 :)