配置 Wildfly 以对 MariaDB 使用 SSL 连接

Posted 2023-02-24

【中文标题】配置 Wildfly 以对 MariaDB 使用 SSL 连接

【英文标题】：Configure Wildfly to use SSL connection for MariaDB

【发布时间】：2019-03-19 05:03:35

【问题描述】：

我想将 Wildfly 14 配置为使用加密的 JDBC 连接。我试过这个：

玛丽亚数据库：

mysql -u root -p
CREATE USER 'wildfly' IDENTIFIED BY 'qwerty';
CREATE DATABASE production_gateway;
GRANT ALL PRIVILEGES ON production_gateway.* TO 'wildfly'@'%' REQUIRE SSL;
FLUSH PRIVILEGES;

创建证书：

mkdir -p /etc/mysql/ssl
cd /etc/mysql/ssl

sudo openssl genrsa 4096 > ca-key.pem
sudo openssl req -new -x509 -nodes -days 36500 -key ca-key.pem -out cacert.pem
sudo openssl req -newkey rsa:4096 -days 36500 -nodes -keyout server-key.pem -out server-req.pem
sudo openssl rsa -in server-key.pem -out server-key.pem
sudo openssl x509 -req -in server-req.pem -days 36500 -CA cacert.pem -CAkey ca-key.pem -set_serial 01 -out server-cert.pem

sudo openssl req -newkey rsa:2048 -days 36500 -nodes -keyout client-key.pem -out client-req.pem
sudo openssl rsa -in client-key.pem -out client-key.pem
sudo openssl x509 -req -in client-req.pem -days 36500 -CA cacert.pem -CAkey ca-key.pem -set_serial 01 -out client-cert.pem
openssl verify -CAfile cacert.pem server-cert.pem client-cert.pem

在 my.cnf 下的 MariDB 中添加证书

ssl-ca=/etc/mysql/ssl/cacert.pem
ssl-cert=/etc/mysql/ssl/server-cert.pem
ssl-key=/etc/mysql/ssl/server-key.pem

systemctl 重启 mysql

在 Java keystone 中导入证书：

cd /usr/lib/jvm/java-11-openjdk-amd64/lib/security/

openssl x509 -outform der -in /etc/mysql/ssl/client-cert.pem -out certificate.der

keytool -import -alias client -keystore /usr/lib/jvm/java-11-openjdk-amd64/lib/security/cacerts -file certificate.der -srcstorepass changeit

导出keystone配置：

export JAVA_OPTS="-Djavax.net.ssl.keyStore=/usr/lib/jvm/java-11-openjdk-amd64/lib/security/cacerts -Djavax.net.ssl.keyStorePassword=changeit"

当我使用这个连接链接时：

jdbc:mariadb://localhost:3306/production_gateway - 工作正常

但是当我使用：jdbc:mariadb://localhost:3306/production_gateway?useSSL=true&requireSSL=true

我明白了：

17:40:30,454 WARN  [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (External Management Request Threads -- 1) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection
17:40:30,472 ERROR [org.jboss.as.controller.management-operation] (External Management Request Threads -- 1) WFLYCTL0013: Operation ("test-connection-in-pool") failed - address: ([
    ("subsystem" => "datasources"),
    ("data-source" => "MariaDB")
]) - failure description: "WFLYJCA0040: failed to invoke operation: WFLYJCA0047: Connection is not valid"

您能建议我如何解决此问题吗？ 我使用JDBC驱动@​​987654330@

【问题讨论】：

从未尝试过。但是 &requireSSL 不是必须是 &requireSSL=true 吗？

抱歉，拼写错误。

developer.jboss.org/thread/277264此链接可能对您有所帮助

【参考方案1】：

据我所知，您只需将requireSSL 字段提供给true。

尝试以下行：

jdbc:mariadb://localhost:3306/production_gateway?requireSSL=true

让我们知道它是否有效。

如需更多说明，您可以查看this answer。