2016-05-23 372 views
1

我已经创建了自己的证书和配置postgresql.conf文件:如何通过SSL连接PostgreSQL数据库?

... 
#authentication_timeout = 1min   # 1s-600s 
ssl = true        # (change requires restart) 
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers 
             # (change requires restart) 
#ssl_prefer_server_ciphers = on   # (change requires restart) 
#ssl_ecdh_curve = 'prime256v1'   # (change requires restart) 
ssl_cert_file = '/etc/ssl/certs/company/database/certificate'   # (change requires restart) 
ssl_key_file = '/etc/ssl/certs/company/database/key'   # (change requires restart) 
ssl_ca_file = '/usr/share/ca-certificates/company/ca/certificate'      # (change requires restart) 
#ssl_crl_file = ''      # (change requires restart) 
#password_encryption = on 
#db_user_namespace = off 
#row_security = on 
... 

然后,我让我的服务器与我的数据库连接,pg_hba.conf

... 
hostssl postgres    postgres    XXX.XXX.XXX.XXX/0   md5 
... 

所以,我可以通过psql连接到它命令行:

psql (9.5.3) 
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off) 
Type "help" for help. 

postgres=# 

但是,当我尝试通过我的jav打开与数据库的连接一个应用程序,甚至当我提供信任与我的数据库证书包括,我不断收到与它没有关系:

mvn package -Djavax.net.ssl.trustStore=/opt/app/truststore -Djavax.net.ssl.trustStorePassword=changeit 

例外:

2016-05-23 16:28:32,900 WARN [com.mchange.v2.resourcepool.BasicResourcePool] - <Having failed to acquire a resource, [email protected] is interrupting all Threads waiting on a resource to check out. Will try again in response to new client requests.> 
2016-05-23 16:28:32,900 WARN [com.mchange.v2.resourcepool.BasicResourcePool] - <com[email protected]2be057bf -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception: > 
java.lang.NullPointerException 
    at org.postgresql.Driver.parseURL(Driver.java:532) 
    at org.postgresql.Driver.acceptsURL(Driver.java:431) 
    at java.sql.DriverManager.getDriver(DriverManager.java:299) 
    at com.mchange.v2.c3p0.DriverManagerDataSource.driver(DriverManagerDataSource.java:285) 
    at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:161) 
    at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:161) 
    at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:147) 
    at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:202) 
    at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1138) 
    at com.mchange.v2.resourcepool.BasicResourcePool.doAcquireAndDecrementPendingAcquiresWithinLockOnSuccess(BasicResourcePool.java:1125) 
    at com.mchange.v2.resourcepool.BasicResourcePool.access$700(BasicResourcePool.java:44) 
    at com.mchange.v2.resourcepool.BasicResourcePool$ScatteredAcquireTask.run(BasicResourcePool.java:1870) 
    at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:696) 
2016-05-23 16:28:32,901 WARN [com.mchange.v2.resourcepool.BasicResourcePool] - <Having failed to acquire a resource, [email protected] is interrupting all Threads waiting on a resource to check out. Will try again in response to new client requests.> 

通过psql似乎一切都工作正常,不与我的申请。 有什么建议吗?

编辑:

props.properties文件:

uatDb.user=postgres 
uatDb.password=password 
uatDb.driverClass=org.postgresql.Driver 
uatDb.jdbcUrl=jdbc:postgresql://<server_name>:1234/uat?ssl=true 
uatDb.port=5443 
uatDb.name=uat 
uatDb.host=<server_name> 
+1

发布您的Java代码。你是否设置SSL的连接属性?请参阅https://jdbc.postgresql.org/documentation/head/connect.html –

+0

@AndrewHenle是的,我已经在文件上设置了此连接的属性。我编辑了我的问题。我通过'maven'调用我的数据库来构建我的应用程序,以访问我的数据库以进行一些测试。 –

+0

假设您的连接工程未启用SSL,您能否在MAVEN_OPTS中设置'-Djavax.net.debug = all'以获取Java连接调试数据?见http://stackoverflow.com/questions/2007192/maven-jetty-plugin-how-to-control-vm-arguments(我不是Maven大师......) –

回答

1

需要一个密钥太相信。由于ssl = true应该需要私钥用于您的自签名证书。我还要补充“非验证SSLFactory”设置

?ssl=true&amp;sslfactory=org.postgresql.ssl.NonValidatingFactory 

而且你的端口设置服务器名:1234不符5432

“的parseURL”是一个空的错误,也许有JDBC URL中的变量某处这是不正确的设置。

+0

“org.postgresql.ssl.NonValidatingFactory”工厂绕过所有SSL证书验证,使SSL连接毫无意义。 –