使用 PEM 文件的 Zookeeper TLS 设置答案

【问题标题】：Zookeeper TLS setup using PEM file使用 PEM 文件的 Zookeeper TLS 设置
【发布时间】：2020-04-10 19:37:40
【问题描述】：

我看到 zookeeper 3.5.5 可以选择传入 .PEM 文件来设置 TLS 加密。我有使用 openssl 生成的服务器 certificate.pem 和 privatekey.pem 并设置 zookeper 配置如下

tickTime=2000
dataDir=/var/lib/zookeeper
clientPort=2181
initLimit=5
syncLimit=2
server.1=10.247.246.3:2888:3888
server.2=10.247.246.4:2888:3888
server.3=10.247.246.5:2888:3888

sslQuorum=true
serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
ssl.quorum.keyStore.location=/tmp/zoo/apache-zookeeper-3.5.7-bin/bin/certs/test/certWithPrivateKey.pem
ssl.quorum.keyStore.password=********
ssl.quorum.trustStore.location=/path/to/ca/ca-cert.pem
ssl.quorum.trustStore.password=******
ssl.hostnameVerification=false
ssl.quorum.hostnameVerification=false
ssl.keyStore.type=PEM
ssl.quorum.keyStore.type=PEM
ssl.trustStore.type=PEM
ssl.quorum.trustStore.type=PEM

但我在启动 zookeeper 时收到此错误。

org.apache.zookeeper.common.X509Exception$SSLContextException: Failed to create KeyManager
        at org.apache.zookeeper.common.X509Util.createSSLContextAndOptionsFromConfig(X509Util.java:350)
        at org.apache.zookeeper.common.X509Util.createSSLContextAndOptions(X509Util.java:328)
        at org.apache.zookeeper.common.X509Util.createSSLContextAndOptions(X509Util.java:282)
        at org.apache.zookeeper.common.X509Util.getDefaultSSLContextAndOptions(X509Util.java:262)
        at org.apache.zookeeper.common.X509Util.createSSLSocket(X509Util.java:517)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.connectOne(QuorumCnxManager.java:672)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.connectOne(QuorumCnxManager.java:748)
        at org.apache.zookeeper.server.quorum.QuorumCnxManager.connectAll(QuorumCnxManager.java:776)
        at org.apache.zookeeper.server.quorum.FastLeaderElection.lookForLeader(FastLeaderElection.java:958)
        at org.apache.zookeeper.server.quorum.QuorumPeer.run(QuorumPeer.java:1425)
Caused by: org.apache.zookeeper.common.X509Exception$KeyManagerException: java.io.IOException: overrun, bytes = 111
        at org.apache.zookeeper.common.X509Util.createKeyManager(X509Util.java:447)
        at org.apache.zookeeper.common.X509Util.createSSLContextAndOptionsFromConfig(X509Util.java:348)
        ... 9 more
Caused by: java.io.IOException: overrun, bytes = 111
        at java.base/javax.crypto.EncryptedPrivateKeyInfo.<init>(EncryptedPrivateKeyInfo.java:95)
        at org.apache.zookeeper.util.PemReader.loadPrivateKey(PemReader.java:154)
        at org.apache.zookeeper.util.PemReader.loadPrivateKey(PemReader.java:142)
        at org.apache.zookeeper.util.PemReader.loadKeyStore(PemReader.java:103)
        at org.apache.zookeeper.common.PEMFileLoader.loadKeyStore(PEMFileLoader.java:50)
        at org.apache.zookeeper.common.X509Util.loadKeyStore(X509Util.java:400)
        at org.apache.zookeeper.common.X509Util.createKeyManager(X509Util.java:436)

注意：我检查了 zookeeper 源代码PEMReader.java，因为代码期望密钥和证书在 PEM 文件中。我通过连接 certificate.pem 和 privatekey.pem 创建了 certWithPrivate.pem (cat certificate.pem privatekey.pem > certWithPrivate.pem)

有什么想法吗？

【问题讨论】：

标签： ssl openssl apache-zookeeper pem

【解决方案1】：

私钥未加密，删除密码（ssl.quorum.keyStore.password & ssl.quorum.trustStore.password）有效。

参考：Exception when Constructing EncryptedPrivateKeyInfo

【讨论】：