Elasticsearch跨节点握手空证书链问题（不同节点证书不同）

问题场景 #

双节点Elasticsearch集群配置了X-Pack SSL，核心配置如下：

xpack.security.enabled: true
xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: "certificate"
xpack.security.transport.ssl.keystore.path: "application.keystore"
xpack.security.http.ssl.verification_mode: "certificate"
xpack.security.http.ssl.keystore.path: "application.keystore"
xpack.security.transport.ssl.truststore.path: "client.truststore"
xpack.security.transport.ssl.truststore.password: "pass"
xpack.security.transport.ssl.keystore.password: "pass"
xpack.security.http.ssl.keystore.password: "pass"
xpack.security.transport.ssl.keystore.key_password: "pass"
xpack.security.http.ssl.keystore.key_password: "pass"

每个节点使用CA签名的独立证书，且已将对方证书加入各自信任库，但跨节点通信时抛出错误：

javax.net.ssl|SEVERE|B1|elasticsearch[node][transport_worker][T#66]|2023-05-02 15:08:56.928 UTC|TransportContext.java:316|Fatal (BAD_CERTIFICATE): Empty client certificate chain ( [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] "throwable" : { [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] javax.net.ssl.SSLHandshakeException: Empty client certificate chain [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.Alert.createSSLException(Alert.java:131) [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.Alert.createSSLException(Alert.java:117) [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.TransportContext.fatal(TransportContext.java:311) [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.TransportContext.fatal(TransportContext.java:267) [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.TransportContext.fatal(TransportContext.java:258) [2023-05-02T15:08:56,928][WARN ][stderr ] [node-mdtwnmst01ap02] at sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1193)

SSL调试显示：服务器端发送证书后，客户端能在信任库中找到对应证书，但返回空证书链。

触发条件：仅在使用不同CA签名证书+配置独立信任库时出现；单证书无信任库、单证书链（自签/无中间CA的CA签证书）场景下正常。

排查与解决步骤 #

1. 验证Keystore的完整证书链 #

每个节点的application.keystore必须包含节点证书+CA根证书的完整链，否则客户端无法构建有效证书链发送。用以下命令检查：

keytool -list -v -keystore application.keystore

如果缺少CA根证书，执行导入：

keytool -importcert -alias ca-root -file ca.crt -keystore application.keystore -storepass pass

2. 确保信任库与密钥库的证书一致性 #

将CA根证书同时导入双方节点的client.truststore和application.keystore，保证双向SSL认证时，双方既能验证对方证书，也能提供自身完整的证书链。

3. 检查密钥库的私钥条目有效性 #

确认Keystore中的节点证书私钥条目完整无损坏，导出证书验证：

keytool -exportcert -alias <节点证书别名> -file node.crt -keystore application.keystore -storepass pass

将导出的证书导入对方节点的信任库，检查是否存在：

keytool -list -v -keystore client.truststore | grep <节点证书别名>

4. 核对节点SSL配置对称性 #

两个节点的Transport SSL配置需完全对称，除Keystore路径（若使用不同文件名），其他参数如密码、验证模式、Truststore路径必须一致。

5. 调整SSL验证模式（可选） #

当前verification_mode: "certificate"仅验证证书有效性，若证书CN/SAN与节点主机名匹配，可尝试切换为full模式，强制主机名验证，排除证书与节点身份不匹配的问题：

xpack.security.transport.ssl.verification_mode: "full"

内容的提问来源于stack exchange，提问作者Diana Mihutescu