Spark 3.4.2通过SSL连接MongoDB失败求助

环境与证书信息 #

• 使用Spark 3.4.2版本，通过PySpark连接MongoDB
• 数据库部门提供两个PEM文件：
  1. CA.pem（包含两份证书）：

  -----BEGIN CERTIFICATE-----
  GHHSBBBMMM,,,,........
  -----END CERTIFICATE-------
  -----BEGIN CERTIFICATE-----
  ABCBBBCCCBBB..... 
  -----END CERTIFICATE-----
  

  2. mongo.pem（包含证书及私钥）：

  -----BEGIN CERTIFICATE----- 
  LLKKIISOOSSS,,,........ 
  -----END CERTIFICATE-----
  -----BEGIN PRIVATE KEY----- 
  ANNmmmMMM .... .... 
  -----END PRIVATE KEY-----
  

操作步骤 #

1. 将CA.pem转换为CA.cert后，用keytool生成JKS格式信任库：

keytool -importcert -file CA.pem -alias ca-cert-alias -keystore trustStoremongo.jks -storepass pass

2. 首次提交Spark任务（同时使用信任库和密钥库）：

spark-submit --packages org.mongodb.spark:mongo-spark-connector_2.12:3.0.2 \
--driver-java-options -Djavax.net.ssl.trustStore=trustStoremongo.jks \
--driver-java-options -Djavax.net.ssl.trustStorePassword=pass \
--driver-java-options -Djavax.net.ssl.keyStore=keyStore.jks \
--driver-java-options -Djavax.net.ssl.keyStorePassword=pass \
--conf spark.executor.extraJavaOptions=--Djavax.net.ssl.trustStore=trustStoremongo.jks \
--conf spark.executor.extraJavaOptions=--Djavax.net.ssl.trustStorePassword=pass \
--conf spark.executor.extraJavaOptions=--Djavax.net.ssl.keyStore=keyStore.jks \
--conf spark.executor.extraJavaOptions=--Djavax.net.ssl.keyStorePassword=pass \
testmongoProd.py

错误情况 #

情况1：同时使用信任库和密钥库时 #

抛出如下错误：

com.mongodb.MongoSocketReadException: Prematurely reached end of stream
        at com.mongodb.internal.connection.SocketStream.read(SocketStream.java:112)
        at com.mongodb.internal.connection.InternalStreamConnection.receiveResponseBuffers(InternalStreamConnection.java:579)
        at com.mongodb.internal.connection.InternalStreamConnection.receiveMessage(InternalStreamConnection.java:444)
        at com.mongodb.internal.connection.InternalStreamConnection.receiveCommandMessageResponse(InternalStreamConnection.java:298)
        at com.mongodb.internal.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:258)
        at com.mongodb.internal.connection.CommandHelper.sendAndReceive(CommandHelper.java:83)
        at com.mongodb.internal.connection.CommandHelper.executeCommand(CommandHelper.java:33)

情况2：仅使用信任库时 #

提交命令改为：

spark-submit --packages org.mongodb.spark:mongo-spark-connector_2.12:3.0.2 --driver-java-options -Djavax.net.ssl.trustStore=path/to/cert/trustStoremongo.jks --driver-java-options -Djavax.net.ssl.trustStorePassword=pass --conf spark.executor.extraJavaOptions=--Djavax.net.ssl.trustStore=/path/to/certs/trustStoremongo.jks --conf spark.executor.extraJavaOptions=--Djavax.net.ssl.trustStorePassword=pass testmongoProd.py

抛出如下错误：

Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
        at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:795)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
        at java.base/java.security.KeyStore.load(KeyStore.java:1479)
        at java.base/sun.security.ssl.TrustStoreManager$TrustAnchorManager.loadKeyStore(TrustStoreManager.java:365)
        at java.base/sun.security.ssl.TrustStoreManager$TrustAnchorManager.getTrustedCerts(TrustStoreManager.java:313)
        at java.base/sun.security.ssl.TrustStoreManager.getTrustedCerts(TrustStoreManager.java:55)
        at java.base/sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:49)
        ... 19 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
        at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:793)
        ... 25 more
24/08/27 18:34:13 INFO cluster: Exception in monitor thread while connecting to server np-pri-mongo-db-02.nayapay.com:27003
com.mongodb.MongoClientException: Unable to create default SSLContext
        at com.mongodb.connection.SocketStreamFactory.getSslContext(SocketStreamFactory.java:90)
        at com.mongodb.connection.SocketStreamFactory.create(SocketStreamFactory.java:78)
        at com.mongodb.internal.connection.InternalStreamConnection.open(InternalStreamConnection.java:125)
        at com.mongodb.internal.connection.DefaultServerMonitor$ServerMonitorRunnable.run(DefaultServerMonitor.java:117)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
        at java.base/java.security.Provider$Service.newInstance(Provider.java:1912)
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
        at java.base/javax.net.ssl.SSLContext.getInstance(SSLContext.java:168)
        at java.base/javax.net.ssl.SSLContext.getDefault(SSLContext.java:99)
        at com.mongodb.connection.SocketStreamFactory.getSslContext(SocketStreamFactory.java:88)
        ... 4 more
Caused by: java.security.KeyStoreException: problem accessing trust store
        at java.base/sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:73)
        at java.base/javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:278)
        at java.base/sun.security.ssl.SSLContextImpl$DefaultManagersHolder.getTrustManagers(SSLContextImpl.java:1036)
        at java.base/sun.security.ssl.SSLContextImpl$DefaultManagersHolder.<clinit>(SSLContextImpl.java:1006)
        at java.base/sun.security.ssl.SSLContextImpl$DefaultSSLContext.<init>(SSLContextImpl.java:1181)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
        at java.base/java.security.Provider.newInstanceUtil(Provider.java:156)
        at java.base/java.security.Provider$Service.newInstance(Provider.java:1905)
        ... 9 more
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
        at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:795)
        at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:243)
        at java.base/java.security.KeyStore.load(KeyStore.java:1479)
        at java.base/sun.security.ssl.TrustStoreManager$TrustAnchorManager.loadKeyStore(TrustStoreManager.java:365)
        at java.base/sun.security.ssl.TrustStoreManager$TrustAnchorManager.getTrustedCerts(TrustStoreManager.java:313)
        at java.base/sun.security.ssl.TrustStoreManager.getTrustedCerts(TrustStoreManager.java:55)
        at java.base/sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:49)
        ... 19 more

已确认信息 #

• 信任库和密钥库的密码正确
• 通过keytool -list命令验证了信任库和密钥库均存在

寻求解决方案。

内容的提问来源于stack exchange，提问作者Muhammad Affan