启用JMX SSL后无法用JConsole连接Cassandra 4的问题求助

问题场景 #

我正在使用Cassandra 4并已启用SSL，在cassandra-env.sh中添加以下JVM参数后启动Cassandra：

JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl=true"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.registry.ssl=true"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.need.client.auth=false"

JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStore=/home/murali/cassandra/cassandra4.0.13/conf/certs/keystore.cass4"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.keyStorePassword=cassandra"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStore=/home/murali/cassandra/cassandra4.0.13/conf/certs/cassandra4.client.truststore.jks"
JVM_OPTS="$JVM_OPTS -Djavax.net.ssl.trustStorePassword=cassandra"

#JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=TLSv1.2"
#JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

随后尝试通过以下命令用JConsole连接：

$ jconsole -J-Djavax.net.ssl.keyStore=certs/keystore.cass4
  -J-Djavax.net.ssl.keyStorePassword=cassandra 
  -J-Djavax.net.ssl.trustStore=certs/cassandra4.client.truststore.jks
  -J-Djavax.net.ssl.trustStorePassword=cassandra

但JMX SSL连接失败，使用javax.rmi包编写Java代码连接时，抛出如下错误：

java.io.IOException: Failed to retrieve RMIServer stub: javax.naming.CommunicationException [Root exception is java.rmi.NoSuchObjectException: no such object in table]

注：分别使用JDK 8和11运行JConsole及Java代码，错误一致。

解决方案 #

1. 验证证书配置一致性 #

• 确保Cassandra服务端的keystore和truststore路径为绝对路径，且Cassandra进程对文件拥有读取权限
• 客户端（JConsole/Java代码）的证书路径建议改用绝对路径，避免相对路径导致的文件找不到问题
• 使用keytool工具验证证书有效性，确认证书已正确导入：

  keytool -list -v -keystore /home/murali/cassandra/cassandra4.0.13/conf/certs/keystore.cass4 -storepass cassandra
  keytool -list -v -keystore /home/murali/cassandra/cassandra4.0.13/conf/certs/cassandra4.client.truststore.jks -storepass cassandra
  

• 即使当前设置need.client.auth=false，也要确保服务端truststore包含客户端证书的信任链，避免SSL握手失败

2. 完善Cassandra JVM参数 #

在cassandra-env.sh中补充必要的JMX远程连接参数，取消SSL协议和加密套件的注释：

# 新增JMX端口与绑定配置
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.port=7199"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.rmi.port=7199"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.host=0.0.0.0"
JVM_OPTS="$JVM_OPTS -Djava.rmi.server.hostname=<你的Cassandra节点IP>"

# 启用指定SSL协议与加密套件
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.protocols=TLSv1.2"
JVM_OPTS="$JVM_OPTS -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

注意：jmxremote.port和rmi.port必须设为同一个值，避免RMI随机端口引发网络问题；java.rmi.server.hostname需设置为客户端可访问的节点IP。

3. 调整JConsole连接命令 #

使用绝对路径指定证书，并显式指定JMX服务地址，JDK 11可添加SASL禁用参数：

jconsole -J-Djavax.net.ssl.keyStore=/home/murali/cassandra/cassandra4.0.13/conf/certs/keystore.cass4 \
  -J-Djavax.net.ssl.keyStorePassword=cassandra \
  -J-Djavax.net.ssl.trustStore=/home/murali/cassandra/cassandra4.0.13/conf/certs/cassandra4.client.truststore.jks \
  -J-Djavax.net.ssl.trustStorePassword=cassandra \
  -J-Dcom.sun.management.jmxremote.sasl.enabled=false \
  service:jmx:rmi:///jndi/rmi://<Cassandra节点IP>:7199/jmxrmi

4. 修正Java代码连接逻辑 #

确保代码中指定正确的JMX URL与证书参数，JDK 11需禁用SASL：

import javax.management.MBeanServerConnection;
import javax.management.remote.JMXConnector;
import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL;

public class JmxSslClient {
    public static void main(String[] args) throws Exception {
        // 设置SSL证书参数
        System.setProperty("javax.net.ssl.keyStore", "/home/murali/cassandra/cassandra4.0.13/conf/certs/keystore.cass4");
        System.setProperty("javax.net.ssl.keyStorePassword", "cassandra");
        System.setProperty("javax.net.ssl.trustStore", "/home/murali/cassandra/cassandra4.0.13/conf/certs/cassandra4.client.truststore.jks");
        System.setProperty("javax.net.ssl.trustStorePassword", "cassandra");
        // JDK11禁用SASL认证
        System.setProperty("com.sun.management.jmxremote.sasl.enabled", "false");

        // 连接Cassandra JMX服务
        String jmxUrl = "service:jmx:rmi:///jndi/rmi://<Cassandra节点IP>:7199/jmxrmi";
        JMXServiceURL serviceUrl = new JMXServiceURL(jmxUrl);
        JMXConnector connector = JMXConnectorFactory.connect(serviceUrl, null);
        MBeanServerConnection connection = connector.getMBeanServerConnection();

        // 示例：获取Cassandra节点状态指标
        String nodeStatus = (String) connection.getAttribute(new javax.management.ObjectName("org.apache.cassandra.db:type=StorageService"), "Status");
        System.out.println("Cassandra Node Status: " + nodeStatus);

        connector.close();
    }
}

5. 网络与权限排查 #

• 检查Cassandra节点的7199端口是否对外开放，防火墙/安全组需允许客户端访问该端口
• 查看Cassandra日志（logs/system.log），搜索JMX相关报错信息，定位证书加载、端口绑定等具体问题
• 确保Cassandra进程运行用户对证书文件拥有读取权限

内容的提问来源于stack exchange，提问作者trendy innovative