启用加密连接到YugabyteDB的问题

Question

[用户在YugabyteDB社区板上发布的问题]

无论使用哪个目录名来保存证书文件，我都会一次又一次地遇到问题。我使用以下方法创建集群：

wget https://raw.githubusercontent.com/yugabyte/yugabyte-db/master/ent/test_certs/ca.crt
wget -O node.172.31.7.240.key https://raw.githubusercontent.com/yugabyte/yugabyte-db/master/ent/test_certs/ysql.key
wget -O node.172.31.7.240.crt https://raw.githubusercontent.com/yugabyte/yugabyte-db/master/ent/test_certs/ysql.crt
chmod 600 ca.crt node.172.31.7.240.key node.172.31.7.240.crt
CERTS=`pwd`
ENABLE_TLS="use_client_to_server_encryption=true,certs_for_client_dir=$CERTS"
yb-ctl destroy && yb-ctl create --listen_ip=172.31.7.240 --tserver_flags="$ENABLE_TLS,ysql_enable_auth=true" --ysql_hba_conf_csv="hostssl all all all md5 clientcert=1"
Creating cluster.
Waiting for cluster to be ready.
.
----------------------------------------------------------------------------------------------------
| Node Count: 1 | Replication Factor: 1                                                            |
----------------------------------------------------------------------------------------------------
| JDBC                : jdbc:postgresql://172.31.7.240:5433/yugabyte                               |
| YSQL Shell          : yugabyte-2.11.1.0/bin/ysqlsh -h 172.31.7.240                               |
| YCQL Shell          : yugabyte-2.11.1.0/bin/ycqlsh 172.31.7.240                                  |
| YEDIS Shell         : yugabyte-2.11.1.0/bin/redis-cli -h 172.31.7.240                            |
| Web UI              : http://172.31.7.240:7000/                                                  |
| Cluster Data        : /root/yugabyte-data                                                        |
----------------------------------------------------------------------------------------------------
For more info, please use: yb-ctl status

试图在ysqlsh中连接：

root@ip-172-31-7-240:~# ysqlsh -h 172.31.7.240
ysqlsh: could not connect to server: Connection refused
        Is the server running on host "172.31.7.240" and accepting
        TCP/IP connections on port 5433?

试图在ycqlsh中连接：

root@ip-172-31-7-240:~# ycqlsh 172.31.7.240
Connected to local cluster at 172.31.7.240:9042.
[ycqlsh 5.0.1 | Cassandra 3.9-SNAPSHOT | CQL spec 3.4.2 | Native protocol v4]
Use HELP for help.
ycqlsh>

现在，我只使用docs https://docs.yugabyte.com/preview/secure/tls-encryption/tls-authentication/中提到的以下文件创建了集群

root@ip-172-31-7-240:~/172.31.7.240# ls -ltr
total 12
-rw------- 1 root root  977 Jun 28 13:53 ca.crt
-rw------- 1 root root 1679 Jun 28 13:53 node.127.0.0.1.key
-rw------- 1 root root 3625 Jun 28 13:53 node.127.0.0.1.crt

现在，集群已启动并运行，但无法与此证书连接：

root@ip-172-31-7-240:~/172.31.7.240# ysqlsh "sslmode=require sslrootcert=/root/172.31.7.240/ca.crt"
ysqlsh: FATAL:  connection requires a valid client certificate
root@ip-172-31-7-240:~/172.31.7.240# ls -ltr /root/172.31.7.240/ca.crt
-rw------- 1 root root 977 Jun 28 13:53 /root/172.31.7.240/ca.crt
root@ip-172-31-7-240:~/172.31.7.240# chmod 600 *
root@ip-172-31-7-240:~/172.31.7.240# ysqlsh "sslmode=require sslrootcert=/root/172.31.7.240/ca.crt"
ysqlsh: FATAL:  connection requires a valid client certificate
root@ip-172-31-7-240:~/172.31.7.240#

Answer 1

看来这个问题现在已经解决了。当我使用listen_ip时，我需要同时提供127.0*和172的文件。

 ls -ltr
total 12
-rw------- 1 root root  977 Jun 28 13:53 ca.crt
-rw------- 1 root root 1679 Jun 28 13:53 node.127.0.0.1.key
-rw------- 1 root root 3625 Jun 28 13:53 node.127.0.0.1.crt
root@ip-172-31-7-240:~/172.31.7.240#
root@ip-172-31-7-240:~/172.31.7.240# cp node.127.0.0.1.key node.172.31.7.240.key
root@ip-172-31-7-240:~/172.31.7.240# cp node.127.0.0.1.crt  node.172.31.7.240.crt
root@ip-172-31-7-240:~/172.31.7.240# ls -ltr
total 20
-rw------- 1 root root  977 Jun 28 13:53 ca.crt
-rw------- 1 root root 1679 Jun 28 13:53 node.127.0.0.1.key
-rw------- 1 root root 3625 Jun 28 13:53 node.127.0.0.1.crt
-rw------- 1 root root 1679 Jun 28 15:14 node.172.31.7.240.key
-rw------- 1 root root 3625 Jun 28 15:15 node.172.31.7.240.crt
root@ip-172-31-7-240:~/172.31.7.240#
root@ip-172-31-7-240:~/172.31.7.240# yb-ctl destroy && yb-ctl create --listen_ip=172.31.7.240 --tserver_flags="$ENABLE_TLS,ysql_enable_auth=true" --ysql_hba_conf_csv="hostssl all all all md5 clientcert=1"
Destroying cluster.
Creating cluster.
Waiting for cluster to be ready.
----------------------------------------------------------------------------------------------------
| Node Count: 1 | Replication Factor: 1                                                            |
----------------------------------------------------------------------------------------------------
| JDBC                : jdbc:postgresql://172.31.7.240:5433/yugabyte                               |
| YSQL Shell          : ~/yugabyte-2.11.1.0/bin/ysqlsh -h 172.31.7.240                             |
| YCQL Shell          : ~/yugabyte-2.11.1.0/bin/ycqlsh 172.31.7.240                                |
| YEDIS Shell         : ~/yugabyte-2.11.1.0/bin/redis-cli -h 172.31.7.240                          |
| Web UI              : http://172.31.7.240:7000/                                                  |
| Cluster Data        : /root/yugabyte-data                                                        |
----------------------------------------------------------------------------------------------------

ysqlsh -h 172.31.7.240 "sslcert=$CERTS/node.172.31.7.240.crt  sslkey=$CERTS/node.172.31.7.240.key  sslrootcert=$CERTS/ca.crt"
Password for user yugabyte:
ysqlsh (11.2-YB-2.11.1.0-b0)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
yugabyte=#

我现在能够连接到服务器。