Using Elasticsearch Java REST API with self signed certificates

Question

I want to use the Java REST API (RestHighLevelClient) to communicate with an Elasticsearch 5.6 server over HTTPS. However, the certificate for the server is self signed and when I try to connect it throws a SSLHandshakeException.

Is there a way of configuring the REST client to accept self signed certificates?

James Baker · Accepted Answer · 2017-11-17 08:41:57Z

5

I got this working using a custom Java Key Store. Here's my code:

CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(username, password));

final SSLContext sslContext = SSLContexts.custom()
        .loadTrustMaterial(new File("my_keystore.jks"), keystorePassword.toCharArray(),
            new TrustSelfSignedStrategy())
        .build();


RestClient client = RestClient.builder(new HttpHost(host, port, scheme)).setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
        .setDefaultCredentialsProvider(credentialsProvider)
        .setSSLContext(sslContext)
).build();

To create the keystore, I downloaded the cert for the domain through Firefox, and used:

keytool -import -v -trustcacerts -file my_domain.crt -keystore my_keystore.jks -keypass password -storepass password

answered Nov 17, 2017 at 8:41

James Baker

1,2582 gold badges20 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gimby Over a year ago

Using your own keystore is indeed recommended. You could use the standard Java runtime cacerts file too and then you don't need the custom SSLContext, but that file gets overwritten with each runtime update.

Collectives™ on Stack Overflow

Using Elasticsearch Java REST API with self signed certificates

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related