Mongo之SSL配置(服务端,客户端shell,java)-yellowcong

向右看齐 2022-12-23 06:53 459阅读 0赞

> 1.生成证书，根证书，服务端证书，客户端证书  
> 2.配置服务端ssl配置，测试shell访问ssl的服务端,访问mongo  
> 3.生成java的p12证书，java通过ssl的方式访问mongo

## 服务端ssl配置 ##

### 生成证书 ###

#### 生成根证书 ####

#-x509： 用于生成自签证书，如果不是自签证书则不需要此项
    #-days: 证书的有效期限，默认是365天
    #生成根证书
    openssl req -out ca.pem -new -x509 -days 3650
    
    #直接带参数的输入，直接输密码即可
    openssl req -out ca.pem -new -x509 -days 3650 -subj "/C=CN/ST=BeiJing/O=bigdata/CN=server1/CN=yellowcong/emailAddress=yellowcong@qq.com"

生成根证书，可以看到有ca.pem和privkey.pem  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center]

第二种方式，直接输入密码即可，把参数写在命令行上  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 1]

#### 生成服务端证书 ####

# 生成服务器端私钥
    openssl genrsa -out server.key 2048
    
    # 生成服务器端申请文件 cat server.req
    #CN=localhost 是mongo机器运行的节点域名信息，如果对不上就会报错
    openssl req -key server.key -new -out server.req -subj "/C=CN/ST=BeiJing/O=bigdata/CN=server1/CN=localhost/emailAddress=yellowcong@qq.com"
    
    # 生成服务器端证书
    openssl x509 -req -in server.req -CA ca.pem -CAkey privkey.pem -CAcreateserial -out server.crt -days 3650
    
    # 合并服务器端私钥和服务器端证书，生成server.pem
    cat server.key server.crt > server.pem
    
    # 校验服务器端pem文件
    openssl verify -CAfile ca.pem server.pem

生成私钥  
![在这里插入图片描述][20201123152230746.png_pic_center]  
生成server.req的配置，用于生成根证书  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 2]

生成服务端证书，这个地方生成根证书的时候，需要设置密码  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 3]  
合并生成pem文件  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 4]

#### 生成客户端证书 ####

生成客户端证书

# 生成客户端私钥
    openssl genrsa -out client.key 2048
    
    # 生成客户端申请文件
    #CN=localhost 是mongo服务的域名地址，这个需要根据自己业务进行修改处理
    openssl req -key client.key -new -out client.req -subj "/C=CN/ST=BeiJing/O=bigdata/CN=server1/CN=localhost/emailAddress=yellowcong@qq.com"
    
    # 生成客户端证书
    openssl x509 -req -in client.req -CA ca.pem -CAkey privkey.pem -CAserial ca.srl  -out client.crt -days 3650
    
    # 合并客户端私钥和客户端证书，生成client.pem
    cat client.key client.crt > client.pem
    
    # 校验客户端pem文件
    openssl verify -CAfile ca.pem client.pem

生成客户端密钥  
![在这里插入图片描述][20201123153039979.png_pic_center]  
生成客户端req  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 5]

生成客户端证书  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 6]  
生成客户端证书pem  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 7]

### 配置服务端 ###

首先需要对mongodb服务器进行设置，这些设置可以在调用mongod启动mongodb服务器时，通过命令行参数进行指定，也可以通过配置文件进行指定，mongod.conf配置，设置net配置如下：

#bash
    
    #重启mongo服务
    mongod -config /usr/local/mongo/mongodb.conf --shutdown
    
    #--sslCAFile /usr/local/mongo/ssl/ca.pem
    #--sslPEMKeyFile /usr/local/mongo/ssl/server.pem 
    mongod --sslMode requireSSL --sslPEMKeyFile /usr/local/mongo/ssl/server.pem --sslCAFile /usr/local/mongo/ssl/ca.pem --config /usr/local/mongo/mongodb.conf --auth

启动服务，添加ssl配置  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 8]

### shell客户端ssl配置 ###

https://help.aliyun.com/document\_detail/104006.html

#设置ssl配置的shell
    #--sslPEMKeyFile /usr/local/mongo/ssl/client.pem 
    #--sslCAFile /usr/local/mongo/ssl/ca.pem
    mongo --sslAllowInvalidCertificates --sslAllowInvalidHostnames --ssl --sslPEMKeyFile /usr/local/mongo/ssl/client.pem --sslCAFile /usr/local/mongo/ssl/ca.pem --host 127.0.0.1

通过证书访问  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 9]

## java客户端ssl配置 ##

https://www.alibabacloud.com/help/zh/doc-detail/89276.htm  
http://mongodb.github.io/mongo-java-driver/3.0/driver/reference/connecting/ssl/?spm=a2c4g.11186623.2.18.42a950e8Z8UOGB

两种方法，一种是直接导入到jvm ,第二种是动态管理

### 第一种ssl方法 ###

生成证书

#根证书信息 trustStore
    openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name server.12
    
    
    #客户端 keyStore
    openssl pkcs12 -export -in client.pem  -out keystore

使用代码

/** * 测试不包含ssl */
        @Test
        public void testConnectWithSSLKeyStore() throws Exception{ 
    // MongoCredential credential = MongoCredential.createCredential("用户名", "数据库名称", "密码".toCharArray());
            //设置ssl配置
            //openssl pkcs12 -export -in client.pem -out keystore
            String keyStorePath = "/Users/yellowcong/Desktop/keystore";
            String keyStorePwd = "test";
    
            //openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name server.12
            String caKeyStorePath = "/Users/yellowcong/Desktop/server.p12";
            String caKeyStorePwd = "test";
    
            System.setProperty("javax.net.ssl.trustStore",caKeyStorePath);
            System.setProperty("javax.net.ssl.keyStore",keyStorePath);
            System.setProperty("javax.net.ssl.trustStorePassword",keyStorePwd);
            System.setProperty("javax.net.ssl.keyStorePassword",caKeyStorePwd);
    
            //获取默认的ssl配置
            SocketFactory socketFactory = SSLSocketFactory.getDefault();
    
            //设置ssl配置
            MongoClientOptions sslOptions = MongoClientOptions.builder()
                    .socketFactory(socketFactory)
                    .sslEnabled(true)
                    .sslInvalidHostNameAllowed(true)
                    .build();
    
            //init mongo
            String username ="admin";
            String password = "123456";
            String dbName = "admin";
            String ip = "172.16.161.225";
            int port = 27017;
            MongoCredential credential = MongoCredential.createCredential(username, dbName,password.toCharArray());
            MongoClient mongoClient = new MongoClient(new ServerAddress(ip, port),credential,sslOptions);
            System.out.println("Connect to database successfully");
    // DB db = mongoClient.getDB(dbName);//获取数据库
    
            //查看test 数据库的集合信息
            DB db = mongoClient.getDB("test");
            Set<String> collectionNames = db.getCollectionNames();
    // // 打印出test中的集合
            for (String name : collectionNames) { 
                System.out.println("collectionName===" + name);
            }
        }

### 第二种动态加载ssl ###

1.  通过System setProperty设置程序运行时属性的方式，可能会增加程序的不安全性，特别是在使用第三方库的时候。自定义KeyManager TrustManager，生成定制SSLContext实例可以解决这个问题，而且不会污染系统属性。
2.  不需要添加服务端证书至JVM证书库，只需在程序中指定jdk支持格式的证书、client端keystore即可。

#生成p12,server配置
    openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name server_pkcs12
    
    #生成client配置
    openssl pkcs12 -export -out keystore -in client.pem

java测试例子如下

package com.yellowcong.mongo;
    
    import com.mongodb.*;
    import com.mongodb.client.MongoDatabase;
    import org.junit.Test;
    
    import javax.net.SocketFactory;
    import javax.net.ssl.KeyManagerFactory;
    import javax.net.ssl.SSLContext;
    import javax.net.ssl.TrustManagerFactory;
    import java.io.FileInputStream;
    import java.security.KeyStore;
    import java.security.SecureRandom;
    import java.util.Arrays;
    import java.util.Set;
    
    public class TestMongo { 
    
        /** * 测试不包含ssl */
        @Test
        public void testConnectWithSSL() throws Exception{ 
    // MongoCredential credential = MongoCredential.createCredential("用户名", "数据库名称", "密码".toCharArray());
            //设置ssl配置
            //openssl pkcs12 -export -in client.pem -out keystore
            String keyStorePath = "/Users/yellowcong/Desktop/keystore";
            String keyStorePwd = "test";
    
            //openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -name server.12
            String caKeyStorePath = "/Users/yellowcong/Desktop/server.p12";
            String caKeyStorePwd = "test";
    
            // 添加SSL认证
            SocketFactory socketFactory = createSocketFactory(
                    keyStorePath,
                    keyStorePwd,
                    caKeyStorePath,
                    caKeyStorePwd
            );
    
            //设置ssl配置
            MongoClientOptions sslOptions = MongoClientOptions.builder()
                    .socketFactory(socketFactory)
                    .sslEnabled(true)
                    .sslInvalidHostNameAllowed(true)
                    .build();
    
            //init mongo
            String username ="admin";
            String password = "123456";
            String dbName = "admin";
            String ip = "172.16.161.225";
            int port = 27017;
            MongoCredential credential = MongoCredential.createCredential(username, dbName,password.toCharArray());
            MongoClient mongoClient = new MongoClient(new ServerAddress(ip, port),credential,sslOptions);
            System.out.println("Connect to database successfully");
    // DB db = mongoClient.getDB(dbName);//获取数据库
    
            //查看test 数据库的集合信息
            DB db = mongoClient.getDB("test");
            Set<String> collectionNames = db.getCollectionNames();
    // // 打印出test中的集合
            for (String name : collectionNames) { 
                System.out.println("collectionName===" + name);
            }
        }
    
        /** * 创建一个SocketFactory. * * @param keyStorePath keyStore 路径 * @param keyStorePwd keyStore密码 * @param trustStorePath keyStore 真实路径 * @param trustStorePwd keyStore 真实路径 * @return * @throws Exception */
        private static SocketFactory createSocketFactory(String keyStorePath, String keyStorePwd, String trustStorePath, String trustStorePwd) throws Exception { 
            SSLContext sslContext = SSLContext.getInstance("SSL");
            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            FileInputStream myKeyStore = new FileInputStream(keyStorePath);
            keyStore.load(myKeyStore, keyStorePwd.toCharArray());
            myKeyStore.close();
            // default SunX509
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(keyStore, keyStorePwd.toCharArray());
    
            // set up a TrustManager that trusts everything
            // 1.trust specific sslCaKeystore
            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            FileInputStream myTrustStore = new FileInputStream(trustStorePath);
            trustStore.load(myTrustStore, trustStorePwd.toCharArray());
            myTrustStore.close();
            tmf.init(trustStore);
            sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
            return sslContext.getSocketFactory();
        }
        /** * 测试不包含ssl */
        @Test
        public void testConnect(){ 
    // MongoCredential credential = MongoCredential.createCredential("用户名", "数据库名称", "密码".toCharArray());
            String username ="admin";
            String password = "123456";
            String dbName = "admin";
            String ip = "172.16.161.225";
            int port = 27017;
    
            MongoCredential credential = MongoCredential.createCredential(username, dbName,password.toCharArray());
            MongoClient mongoClient = new MongoClient(new ServerAddress(ip, port), Arrays.asList(credential));
            System.out.println("Connect to database successfully");
    // DB db = mongoClient.getDB(dbName);//获取数据库
    
            //查看test 数据库的集合信息
            DB db = mongoClient.getDB("test");
            Set<String> collectionNames = db.getCollectionNames();
    // // 打印出test中的集合
            for (String name : collectionNames) { 
                System.out.println("collectionName===" + name);
            }
        }
    }

https://blog.csdn.net/fzlulee/article/details/99691501

ssl测试登录成功，真的是美滋滋啊  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 10]

## 参考文章 ##

https://docs.mongodb.com/manual/core/security-transport-encryption/  
https://docs.mongodb.com/manual/tutorial/configure-ssl-clients/  
https://www.alibabacloud.com/help/zh/doc-detail/89276.htm  
https://blog.csdn.net/qq\_20996551/article/details/105263451  
https://blog.csdn.net/Loiterer\_Y/article/details/106709978

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/91e899477d674e938555bf3fad7b9804.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 1]: /images/20221120/299205d65e7441679962e1f7a632efd6.png
[20201123152230746.png_pic_center]: /images/20221120/20c068273db549948b111d2cf447c051.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 2]: /images/20221120/8d2523e5cd36471ba6b5bf84149dac46.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 3]: /images/20221120/c9c747b64ba04408b009c07abbabbc25.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 4]: /images/20221120/52c7c6f026354df5aeadb815b3ae8a5c.png
[20201123153039979.png_pic_center]: /images/20221120/a1afe45eda6f43c98ef4fcd093c34a9e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 5]: /images/20221120/130000ddbe4d4c42b3d6eb355834f61b.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 6]: /images/20221120/20af954c8b054f7283197f8902fe345e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 7]: /images/20221120/6a33adc115dc4cecb25bc21cf9a6b446.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 8]: /images/20221120/9fcb89cff8b34de3b18a03a08312e3e3.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 9]: /images/20221120/732d5a284a6b43a59287bbcdae6b436f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3llbGxsb3djb25n_size_16_color_FFFFFF_t_70_pic_center 10]: /images/20221120/a1ff671b3618482f89cfa760dc336ea4.png