CURL可正常访问Elasticsearch，但Python接口不行：问题出在哪？

现状说明 #

• Kibana界面（含Dev Tools）操作Elasticsearch完全正常
• 以下curl命令可正常返回索引列表：

  curl -u "username:password" -k https://server/_cat/indices
  

问题详情 #

1. Elasticsearch Python客户端初始调用失败 #

代码示例：

from elasticsearch import Elasticsearch

basic_auth = ("username", "password")
host = "https://server"
elasticsearch_client = Elasticsearch({"host": host, "scheme": "https"}, basic_auth=basic_auth)
elasticsearch_client.indices.get("*")

报错信息：

elasticsearch.exceptions.ConnectionError: ConnectionError(<urllib3.connection.HTTPConnection object at 0x7fa6c8f96920>:
Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known) caused by: 
NewConnectionError(<urllib3.connection.HTTPConnection object at 0x7fa6c8f96920>: 
Failed to establish a new connection: [Errno 8] nodename nor servname provided, or not known)

2. 尝试绕过SSL限制后返回404 #

修改代码尝试绕过SSL验证：

from elasticsearch import RequestsHttpConnection

elasticsearch_client = Elasticsearch(
    [host],
    connection_class=RequestsHttpConnection,
    http_auth=("username", "password"),
    use_ssl=True,
    verify_certs=False,
)

elasticsearch_client.indices.get("*")

报错信息：

File /usr/local/anaconda3/envs/maintainer-text/lib/python3.10/site-packages/elasticsearch/connection/base.py:330, in Connection._raise_error(self, status_code, raw_data)
    327 except (ValueError, TypeError) as err:
    328     logger.warning("Undecodable raw error response from server: %s", err)
--> 330 raise HTTP_EXCEPTIONS.get(status_code, TransportError)(
    331     status_code, error_message, additional_info
    332 )

NotFoundError: NotFoundError(404, 'Not Found', 'Not Found')

3. requests库调用出现SSL错误 #

代码示例：

import requests

requests.get("https://server/_cat/indices", auth=("username", "password"))

报错信息：

SSLError: HTTPSConnectionPool(host='es-api.dev.sparkgov.ai', port=443): Max retries exceeded with url: /_cat/indices (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:997)')))

疑问与需求 #

• 诊断是否正确：问题源于缺少正确的SSL证书，curl通过-k绕过验证正常，但Python工具未做对应处理？
• 是否需要向DevOps团队索要.pem证书文件？
• 如何解决这些连接/SSL问题？
• 服务器端能否设置禁止忽略SSL证书？

解决方案 #

1. 修复客户端连接配置错误 #

初始代码的host参数格式错误，不应包含https://前缀，正确写法拆分主机与协议：

from elasticsearch import Elasticsearch

basic_auth = ("username", "password")
elasticsearch_client = Elasticsearch(
    "server",  # 仅填写主机名/IP，不带协议前缀
    scheme="https",
    basic_auth=basic_auth,
    verify_certs=False,  # 临时绕过证书验证，生产环境不建议
)
elasticsearch_client.indices.get("*")

2. 生产环境推荐：使用合法证书验证 #

向DevOps团队索要服务器的CA证书文件（通常为.pem格式），在客户端指定证书路径：

from elasticsearch import Elasticsearch

basic_auth = ("username", "password")
elasticsearch_client = Elasticsearch(
    "server",
    scheme="https",
    basic_auth=basic_auth,
    ca_certs="/path/to/your/ca.pem",  # 替换为实际证书路径
)
elasticsearch_client.indices.get("*")

3. requests库的修复方式 #

• 临时绕过SSL验证：

import requests

requests.get("https://server/_cat/indices", auth=("username", "password"), verify=False)

• 使用合法证书验证：

import requests

requests.get("https://server/_cat/indices", auth=("username", "password"), verify="/path/to/your/ca.pem")

服务器端禁止忽略SSL证书的配置 #

可以通过Elasticsearch配置强制客户端验证证书：

1. 修改elasticsearch.yml配置文件：

xpack.security.transport.ssl.verification_mode: full
xpack.security.http.ssl.verification_mode: full

2. 确保服务器使用可信CA签发的证书（而非自签名），此时客户端必须提供有效证书才能连接，无法通过verify_certs=False绕过。

内容的提问来源于stack exchange，提问作者W.P. McNeill