nebula的ssl证书的私钥加密后,启动失败

  • nebula 版本:3.4.1
  • 部署方式:云端
  • 安装方式:源码
  • 是否上生产环境: N

一开始有nebula.crt和nebula.key两个文件,nebula.key是没有加密的,通过配置以下内容是可以正常启动使用的,进程观察了也是变成https

--cert_path=xxxxxx
--key_path=xxxxx
--enable_ssl=true

后面使用命令

openssl rsa -aes256 -in nebula.key -out nebulapass.key

去加密了私钥,并且密码明文存在了password.txt中

自己也用下面的命令验证了,可以解密key

openssl rsa -in nebulapass.key -check -passin file:password.txt

但是,在nebula中加上配置–password_path,并且–key_path修改成加密后的私钥nebulapass.key后,就没法启动

--cert_path=xxxxxx
--key_path=xxxxx
--password_path=xxxxxx
--enable_ssl=true

报错如下:

E20230819 16:51:05.086705  9953 ThriftServer.cpp:547] Got an exception while setting up the server: Failed to read private key from file: /usr/local/ssl/nebula.key, password file: /usr/local/ssl/nebula_ssl_password.txtFailed to load cert or key at key path /usr/local/ssl/nebulapass.key, cert path /usr/local/ssl/nebula.crt
E20230819 16:51:05.087126  9953 RaftexService.cpp:49] Start raft service failed: Failed to read private key from file: /usr/local/ssl/nebula.key, password file: /usr/local/ssl/nebula_ssl_password.txtFailed to load cert or key at key path /usr/local/ssl/nebulapass.key, cert path /usr/local/ssl/nebula.crt
E20230819 16:51:05.087146  9953 NebulaStore.cpp:60] Start the raft service failed
E20230819 16:51:05.087157  9953 MetaDaemonInit.cpp:95] Nebula store init failed

从目前console的代码来看应该是不支持password_path参数的,https://github.com/vesoft-inc/nebula-console/blob/3992fb91ee0f10318ac6b303b9bfb9fb5bdd630d/main.go#L438-L453

1 个赞

好吧,打扰大家了。原因居然是下面这个命令,把密码写入到一个文件时,会多一个回车 :smiling_face_with_tear:

echo -n $ssl_decrypted >> password.txt

2 个赞

此话题已在最后回复的 7 天后被自动关闭。不再允许新回复。