如何在Neo4j 3.0.3中使用SSL证书

时间:2016-08-18 07:01:22

标签: database ssl neo4j

通过在Windows上从Neo4j 2.3.1更新到Neo4j 3.0.3,我的证书出现问题。根据2.3.1和3.0.3文档:

  

Neo4j还支持链式SSL证书。这需要将PEM格式的所有证书合并到一个文件中,并且私钥需要采用DER格式。

我和this question完全一样,并且在2.3.1中完成了它。当我尝试在3.0.3中使用它们时,我没有运气并且在启动时出现错误。

它们被称为neo4j.certneo4j.key,并根据需要位于certificates文件夹中。

我发现类似的问题已经报告here但是我在Windows服务器上,我实际上需要非自签名的证书。

我得到的错误是:

2016-08-17 01:11:19.095+0000 INFO  Starting...
2016-08-17 01:11:19.548+0000 ERROR Failed to start Neo4j: Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6a32213c' was successfully initialized, but failed to start. Please see attached cause exception. Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6a32213c' was successfully initialized, but failed to start. Please see attached cause exception.
org.neo4j.server.ServerStartupException: Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6a32213c' was successfully initialized, but failed to start. Please see attached cause exception.
  at org.neo4j.server.exception.ServerStartupErrors.translateToServerStartupError(ServerStartupErrors.java:68)
  at org.neo4j.server.AbstractNeoServer.start(AbstractNeoServer.java:217)
  at org.neo4j.server.ServerBootstrapper.start(ServerBootstrapper.java:87)
  at org.neo4j.server.BlockingBootstrapper.start(BlockingBootstrapper.java:43)
  at org.neo4j.server.ServerBootstrapper.start(ServerBootstrapper.java:66)
  at org.neo4j.server.CommunityEntryPoint.start(CommunityEntryPoint.java:38)
Caused by: org.neo4j.kernel.lifecycle.LifecycleException: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6a32213c' was successfully initialized, but failed to start. Please see attached cause exception.
  at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.start(LifeSupport.java:444)
  at org.neo4j.kernel.lifecycle.LifeSupport.start(LifeSupport.java:107)
  at org.neo4j.server.AbstractNeoServer.start(AbstractNeoServer.java:189)
  ... 4 more
Caused by: java.lang.RuntimeException: Error starting org.neo4j.kernel.impl.factory.CommunityFacadeFactory, Y:\neo4j\data\databases\ram.db
  at org.neo4j.kernel.impl.factory.GraphDatabaseFacadeFactory.newFacade(GraphDatabaseFacadeFactory.java:144)
  at org.neo4j.kernel.impl.factory.CommunityFacadeFactory.newFacade(CommunityFacadeFactory.java:40)
  at org.neo4j.kernel.impl.factory.GraphDatabaseFacadeFactory.newFacade(GraphDatabaseFacadeFactory.java:108)
  at org.neo4j.server.CommunityNeoServer.lambda$static$31(CommunityNeoServer.java:55)
  at org.neo4j.server.database.LifecycleManagingDatabase.start(LifecycleManagingDatabase.java:89)
  at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.start(LifeSupport.java:434)
  ... 6 more
Caused by: org.neo4j.kernel.lifecycle.LifecycleException: Component 'org.neo4j.kernel.extension.KernelExtensions@1040a217' failed to initialize. Please see attached cause exception.
  at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.init(LifeSupport.java:416)
  at org.neo4j.kernel.lifecycle.LifeSupport.init(LifeSupport.java:62)
  at org.neo4j.kernel.lifecycle.LifeSupport.start(LifeSupport.java:98)
  at org.neo4j.kernel.impl.factory.GraphDatabaseFacadeFactory.newFacade(GraphDatabaseFacadeFactory.java:140)
  ... 11 more
Caused by: java.lang.RuntimeException: Failed to initilize SSL encryption support, which is required to start this connector. Error was: failed to initialize the server-side SSL context
  at org.neo4j.bolt.BoltKernelExtension.createSslContext(BoltKernelExtension.java:205)
  at org.neo4j.bolt.BoltKernelExtension.lambda$newInstance$14(BoltKernelExtension.java:166)
  at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
  at java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:175)
  at java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:193)
  at java.util.ArrayList.forEach(ArrayList.java:1249)
  at java.util.stream.SortedOps$RefSortingSink.end(SortedOps.java:390)
  at java.util.stream.DistinctOps$1$2.end(DistinctOps.java:168)
  at java.util.stream.Sink$ChainedReference.end(Sink.java:258)
  at java.util.stream.Sink$ChainedReference.end(Sink.java:258)
  at java.util.stream.Sink$ChainedReference.end(Sink.java:258)
  at java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:482)
  at java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:471)
  at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:708)
  at java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
  at java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:499)
  at org.neo4j.bolt.BoltKernelExtension.newInstance(BoltKernelExtension.java:178)
  at org.neo4j.bolt.BoltKernelExtension.newInstance(BoltKernelExtension.java:83)
  at org.neo4j.kernel.extension.KernelExtensions.init(KernelExtensions.java:69)
  at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.init(LifeSupport.java:406)
  ... 14 more
Caused by: javax.net.ssl.SSLException: failed to initialize the server-side SSL context
  at io.netty.handler.ssl.JdkSslServerContext.<init>(JdkSslServerContext.java:222)
  at io.netty.handler.ssl.JdkSslServerContext.<init>(JdkSslServerContext.java:161)
  at io.netty.handler.ssl.SslContext.newServerContextInternal(SslContext.java:399)
  at io.netty.handler.ssl.SslContextBuilder.build(SslContextBuilder.java:207)
  at org.neo4j.bolt.BoltKernelExtension.createSslContext(BoltKernelExtension.java:200)
  ... 33 more
Caused by: java.security.KeyException: found no private key: Y:\neo4j\certificates\neo4j.key
  at io.netty.handler.ssl.PemReader.readPrivateKey(PemReader.java:99)
  at io.netty.handler.ssl.SslContext.buildKeyStore(SslContext.java:890)
  at io.netty.handler.ssl.JdkSslContext.buildKeyManagerFactory(JdkSslContext.java:313)
  at io.netty.handler.ssl.JdkSslContext.buildKeyManagerFactory(JdkSslContext.java:291)
  at io.netty.handler.ssl.JdkSslServerContext.<init>(JdkSslServerContext.java:205)
  ... 37 more

1 个答案:

答案 0 :(得分:1)

好的,有两个原因导致出现此错误。

  • 密钥已加密
  • 密钥是DER格式

即使文档需要DER格式的密钥,看起来Neo4j 3.0.3更喜欢PEM。

以下是使用的方法:

  • 使用以下方式生成密钥和证书:
    • openssl genrsa -out neo4j.key 4096
    • openssl req -new -key neo4j.key -out server.csr
  • 获取CA签署的证书作为PEM Base64
  • 在链中附加其他证书
  • 将证书文件重命名为neo4j.cert

现在您只需将文件添加到certificates文件夹并启动服务器。