【问题标题】:NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory 不可用];
【发布时间】:2019-10-08 17:23:46
【问题描述】:

我正在使用配置了 SSL 的弹性搜索 5.6.15。 我启动并运行了集群,我可以从我的客户端服务器使用 curl 检查弹性集群的运行状况。

弹性搜索文档 https://www.elastic.co/guide/en/x-pack/5.6/java-clients.html

代码尝试

Settings settings = Settings.builder()
    .put("cluster.name", clusterName)
    .put("xpack.security.user", userNamePassword) // Adding Username and Password in XPack Settings for ES.
    .put("xpack.security.transport.ssl.enabled", "true")
    .put("xpack.ssl.key", configFolderPath + "/ssl/client.key")
    .put("xpack.ssl.certificate", configFolderPath + "/ssl/mycrtfile.crt")
    .put("xpack.security.transport.ssl.certificate_authorities", configFolderPath + "/sam/ssl/mychainbundle.crt")

但是,当我尝试使用上述代码调用弹性搜索集群时,出现以下异常:

ElasticsearchException[Failed to load plugin class [org.elasticsearch.xpack.XPackPlugin]]; nested: InvocationTargetException; 
nested: ElasticsearchException[failed to initialize a KeyManagerFactory]; nested: 
PEMException[unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available]; nested: 
NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:384)
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:104)
    at org.elasticsearch.client.transport.TransportClient.newPluginService(TransportClient.java:94)
    at org.elasticsearch.client.transport.TransportClient.buildTemplate(TransportClient.java:119)
    at org.elasticsearch.client.transport.TransportClient.<init>(TransportClient.java:247)
    at org.elasticsearch.transport.client.PreBuiltTransportClient.<init>(PreBuiltTransportClient.java:125)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:55)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:50)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:46)
    at gov.aocs.elastic.search.api.services.SearchController.getNativeElasticSearchConnection(SearchController.java:231)
    at gov.aocs.elastic.search.api.services.SearchController.commonSearch(SearchController.java:422)
    at gov.aocs.elastic.search.api.services.SearchController.searchConfigurable(SearchController.java:615)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
    at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
    at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
    at gov.aocs.elastic.search.api.services.EntitiesCORSFilter.doFilter(EntitiesCORSFilter.java:19)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)
    at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59)
    at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
    at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
    at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:65)
    at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
    at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
    at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
    at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
    at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
    at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
    at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
    at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
    at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
    at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
    at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
    at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
    at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
    at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
    at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
    at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:330)
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:373)
    ... 95 more
Caused by: ElasticsearchException[failed to initialize a KeyManagerFactory]; nested: PEMException[unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available]; nested: NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:69)
    at org.elasticsearch.xpack.ssl.SSLService.createSslContext(SSLService.java:379)
    at org.elasticsearch.xpack.ssl.SSLService.loadSSLConfigurations(SSLService.java:400)
    at org.elasticsearch.xpack.ssl.SSLService.<init>(SSLService.java:78)
    at org.elasticsearch.xpack.XPackPlugin.<init>(XPackPlugin.java:190)
    ... 100 more
Caused by: org.bouncycastle.openssl.PEMException: unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available
    at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getPrivateKey(Unknown Source)
    at org.elasticsearch.xpack.ssl.CertUtils.readPrivateKey(CertUtils.java:272)
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.readPrivateKey(PEMKeyConfig.java:80)
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:64)
    ... 104 more
Caused by: java.security.NoSuchAlgorithmException: 1.2.840.113549.1.1.1 KeyFactory not available
    at java.security.KeyFactory.<init>(KeyFactory.java:138)
    at java.security.KeyFactory.getInstance(KeyFactory.java:172)
    at org.bouncycastle.jcajce.DefaultJcaJceHelper.createKeyFactory(Unknown Source)
    ... 108 more

【问题讨论】:

  • 请粘贴文字而不是图片
  • Settings settings = Settings.builder() .put("cluster.name", clusterName) .put("xpack.security.user", userNamePassword)//在XPack设置中添加用户名和密码ES。 .put("xpack.security.transport.ssl.enabled", "true") .put("xpack.ssl.key", configFolderPath+"/ssl/client.key") .put("xpack.ssl.certificate" , configFolderPath+"/ssl/mycrtfile.crt") .put("xpack.security.transport.ssl.certificate_authorities", configFolderPath+"/sam/ssl/mychainbundle.crt")
  • 我试图发布异常,但它说它太长了。我没有找到如何附加 .txt 文件的选项。
  • ...在问题中,不在评论中。
  • @xtratic - 我也试过..有问题..它说得太长了..

标签: java elasticsearch elasticsearch-x-pack xpack


【解决方案1】:

您的问题的根源似乎是 BouncyCastle 无法从您的 PEM 证书中读取私钥,因为它没有可以处理这种格式的密钥工厂(它甚至不知道它的名称除了 ' 1.2.840.113549.1.1.1')。

OID 1.2.840.113549.1.1.1 用于RSAES-PKCS1-v1_5

首先,我会尝试更新 BouncyCastle,看看是否有新版本可以识别这种格式。

如果这不起作用,那么也许尝试将您的密钥转换为 BouncyCastle 可以识别的其他格式。

您可以使用this answer 中的此命令openssl pkcs12 -export -nocerts -inkey your.private.key.pem -out your.private.key.p12 转换为PKCS12

如果更新 BouncyCastle 或更改您的密钥格式可以解决您的问题,请告诉我们。

【讨论】:

  • 你能告诉我它抱怨的三个文件是哪个文件吗?以下文件来自我的 jboss 服务器 .put("xpack.ssl.key", configFolderPath+"/ssl/client.key") .put("xpack.ssl.certificate", configFolderPath+"/ssl/mycrtfile.crt") 。 put("xpack.security.transport.ssl.certificate_authorities", configFolderPath+"/sam/ssl/mychainbundle.crt") 我正在从我的 jboss 调用弹性搜索节点/服务器,它具有以下文件 mychainbundle.crt entrust_l1k.cer .csr .jks .p12 .pem mycrtfile.sam.gov.crt
  • 我之前使用以下命令生成 .pem 文件,其中我只使用了 pkcs12 openssl pkcs12 -in .p12 -nodes -nocerts -out .pem 我生成的客户端证书下面的命令 openssl pkcs12 -in .p12 -nocerts -nodes > .key 那么你说证书文件上面的弹性服务器有什么问题吗?如果是的话是哪个文件?只是 .pem?
  • 您是否尝试过更新 BouncyCastle?我不确定它到底是哪个文件有问题,只是它试图从 PEM 文件org.bouncycastle.openssl.PEMException: unable to convert key pair: KeyFactory not available ... at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getPrivateKey ... at org.elasticsearch.xpack.ssl.CertUtils.readPrivateKey 中读取私钥
  • 如果你有 BouncyCastle 的源代码,你可以在 JcaPEMKeyConverter.getPrivateKey() 抛出异常的地方设置一个断点,并可能查看异常发生时它在哪个键之后。
  • 唯一可能要转换的键是 OP 告诉它(在配置中)读取的键,即 client.key。这似乎是 Bouncy 1.48 和 1.49 中的一个错误; 1.50 以上有一个介入帮助器方法getKeyFactory,它使用本地 Map 来查找正确的名称,并在 DefaultJcaJceHelper 处调用帮助器。然而,我怀疑名为 PEMKeyConfig 的类将处理不是 PEM 的 PKCS12,更不用说非常非常规的纯密钥 PKCS12。
猜你喜欢
  • 2011-02-20
  • 1970-01-01
  • 2012-01-30
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 2014-04-19
  • 1970-01-01
相关资源
最近更新 更多