2016-09-22 70 views

回答

0

有很多关于通过从论坛上散布的mysql java连接器通过SSL连接到AWS Aurora的信息以及stackoverflow,所以如果我不包含所有引用,请致歉。

长话短说:有连接在EMR集群运行的极光与SSL方案的两个主要问题:

1)只要导入Amazon提供的密钥库RDS-联合CA-bundle.pem将不起作用,因为它会显示“PKIX路径构建失败”错误。

2)Java属性javax.net.ssl.keyStore将无法从群集的奴隶,因此该应用将无法找到密钥库的,会产生一种“通信链路故障”

的原因分析1)似乎与文件rds-combined-ca-bundle.pem具有多个证书的事实有关,因此在论坛中我没有现在的参考,所提出的解决方案是分割这些证书。极光的证书是8:

----- BEGIN CERTIFICATE ----- MIID/DCCAuSgAwIBAgIBQzANBgkqhkiG9w0BAQUFADCBijELMAkGA1UEBhMCVVMx EzARBgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxIjAgBgNVBAoM GUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4xEzARBgNVBAsMCkFtYXpvbiBSRFMx GzAZBgNVBAMMEkFtYXpvbiBSRFMgUm9vdCBDQTAeFw0xNTAyMDUyMTU0MDRaFw0y MDAzMDUyMTU0MDRaMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKV2FzaGluZ3Rv bjEQMA4GA1UEBwwHU2VhdHRsZTEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNl cywgSW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzEgMB4GA1UEAwwXQW1hem9uIFJE UyB1cy1lYXN0LTEgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDI UIuwh8NusKHk1SqPXcP7OqxY3S/M2ZyQWD3w7Bfihpyyy/fc1w0/suIpX3kbMhAV 2ESwged2/2zSx4pVnjp/493r4luhSqQYzru78TuPt9bhJIJ51WXunZW2SWkisSaf USYUzVN9ezR/bjXTumSUQaLIouJt3OHLX49s + 3NAbUyOI8EdvgBQWD68H1epsC0n CI5s + pIktyOZ59c4DCDLQcXErQ + tNbDC++ oct1ANd/q8p9URonYwGCGOBy7sbCYq 9eVHh1Iy2M + SNXddVOGw5EuruvHoCIQyOz5Lz4zSuZA9dRbrfztNOpezCNYu6NKM N + hzcvdiyxv77uNm8EaxAgMBAAGjZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMB Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBQSQG3TmMe6Sa3KufaPBa72v4QFDzAfBgNV HSMEGDAWgBROAu6sPvYVyEztLPUFwY + chAhJgzANBgkqhkiG9w0BAQUFAAOCAQEA L/mOZfB3187xTmjOHMqN2G2oSKHBKiQLM9uv8 + 97qT + XR + TVBT6b3yoPpMAGhHA Pc7nxAF5gPpuzatx0OTLPcmYucFmfqT/1qA5WlgCnMNtczyNMH97lKFTNV7Njtek jWEzAEQS yEWrkNpNlC4j6kMYyPzVXQeXUeZTgJ9FNnVZqmvfjip2N22tawMjrCn5 7KN/zN65EwY2oO9XsaTwwWmBu3NrDdMbzJnbxoWcFWj4RBwanR1XjQOVNhDwmCOl /1Et13b8CPyj69PC8BOVU6cfTSx8WUVy0qvYOKHNY9Bqa5BDnIL3IVmUkeTlM1mt enRpyBj + Bk9rh/ICdiRKmA == ----- END CERTIFICATE -----

所以,如果你提取一个文件称为这一领域,比方说bundle8。 pem,您生成的密钥如下:

keytool -import -alias mysqlServerCACert -file bundle8.pem -keystore truststore 

2)的解决方案是设置javax.net.ssl。的keyStore为命令参数,为的情况下,火花提交,选项应该是“--driver-java的选项”:

spark-submit --deploy-mode cluster --driver-java-options='-Djavax.net.ssl.trustStore=truststore' --files s3://path/to/truststore ..other spark options 

存在“信任”与密钥工具生成的文件。 --driver-java-options将允许truststore文件在从属环境中可用。

参考:

连接到亚马逊极光DB集群: http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Aurora.Connect.html

连接mysql的Java连接器使用SSL https://dev.mysql.com/doc/connector-j/5.1/en/connector-j-reference-using-ssl.html