启用 xpack 后 Elastic Search 无法启动答案

【问题标题】：Elastic Search failed to start after enabling xpack启用 xpack 后 Elastic Search 无法启动
【发布时间】：2021-06-10 05:30:21
【问题描述】：

我正在尝试在 elasticsearch 中启用 xpack，并关注了来自 elasticsearch 站点的入门博客文章。

我做过的事情：

我运行了这个命令$/usr/share/elasticsearch/elasticsearch-certutil cert -out config/elastic-certificates.p12 -pass "" ，并在被要求输入所需的输出文件时输入了/etc/elasticsearch/elastic-certificates.p12。

编辑位于/etc/elasticsearch/elasticsearch.yml 的elasticsearch.yml 配置文件并输入以下行：

 xpack.security.enabled: true
 xpack.security.transport.ssl.enabled: true
 xpack.security.transport.ssl.verification_mode: certificate
 xpack.security.transport.ssl.keystore.path: /etc/elastic-certificates.p12
 xpack.security.transport.ssl.truststore.path: /etc/elastic-certificates.p12

来自/var/log/elasticsearch/elasticsearch.log的日志/异常

2021-06-10T02:58:12,542][ERROR][o.e.b.ElasticsearchUncaughtExceptionHandler] [node-1] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: ElasticsearchSecurityException[failed to load SSL configuration [xpack.security.transport.ssl]]; nested:
 ElasticsearchException[failed to create trust manager]; nested: ElasticsearchException[failed to initialize SSL TrustManager - keystore file [/etc/el
asticsearch/elastic-certificates.p12] does not exist]; nested: AccessDeniedException[/etc/elasticsearch/elastic-certificates.p12];

Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl]

Caused by: java.nio.file.AccessDeniedException: /etc/elasticsearch/elastic-certificates.p12

Caused by: java.nio.file.AccessDeniedException: /etc/elasticsearch/elastic-certificates.p12

Caused by: java.nio.file.AccessDeniedException: /etc/elasticsearch/elastic-certificates.p12

我的.p12 证书文件的权限是rw-------

我在这里错过了什么？

我逐行遵循文档

【问题讨论】：

标签： elasticsearch elasticsearch-x-pack

【解决方案1】：

你在 elasticsearch.yml 中的路径是错误的。

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elastic-certificates.p12

如果您将证书放在 /etc/elasticsearch 文件夹中，请更正它。

xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12

还要确保证书的所有者是 root:elasticsearch

sudo chown root:elasticsearch /etc/elasticsearch/elastic-c*

【讨论】：