mongodb - 无法从 Spark 应用程序连接到启用 SSL 的 mongo 集群

Question

我正在尝试从 spark 应用程序连接到支持 SSL 的 mongo 集群。我正在尝试使用自签名证书并收到以下错误。

Exception in monitor thread while connecting to server CLUSTER_NAME
com.mongodb.MongoSocketWriteException: Exception sending message
    at com.mongodb.internal.connection.InternalStreamConnection.translateWriteException(InternalStreamConnection.java:525)
    at com.mongodb.internal.connection.InternalStreamConnection.sendMessage(InternalStreamConnection.java:413)
    at com.mongodb.internal.connection.InternalStreamConnection.sendCommandMessage(InternalStreamConnection.java:269)
    at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:253)
    at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:83)
    at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:33)
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initializeConnectionDescription(InternalStreamConnectionInitializer.java:106)
    at com.mongodb.internal.connection.InternalStreamConnectionInitializer.initialize(InternalStreamConnectionInitializer.java:63)
    at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:127)
    at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:117)
    at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No name matching CLUSTER_NAME found
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)

我的读取配置 uri 看起来像这样:

    val uri: String = "mongodb://" + URLEncoder.encode(Login, "UTF-8") + ":" + URLEncoder.encode(Password, "UTF-8") + "@" + cluster + ":27017/" + database + "." + collection + "?authSource=" + (if (authenticationDatabase != "") authenticationDatabase else "admin") + (if (replicaset == null) "" else "&replicaSet=" + replicaset) + "&ssl=true"

我想使用像这样的自签名证书:

 class TrustAllX509TrustManager extends X509TrustManager {
    override def getAcceptedIssuers = new Array[X509Certificate](0)

    override def checkClientTrusted(certs: Array[X509Certificate], authType: String): Unit = {
    }

    override def checkServerTrusted(certs: Array[X509Certificate], authType: String): Unit = {
    }
  }

我使用的环境版本:

Spark :2.2.0蒙戈:3.4

任何帮助将不胜感激。

谢谢!

Answer 1

这与建立任何其他 SSL 连接相同。将您的证书导入 keystore 并使用以下代码引用该 keystore

System.setProperty("javax.net.ssl.trustStore", "keystoreFilefullpath")

System.setProperty("javax.net.ssl.trustStorePassword", "password")

一旦设置了这些参数，Kafka SSL 就应该可以工作了。如果您从 Spark 发布，则必须使用 --files 选项将 keystore 文件上传到驱动程序/执行程序