Python通过jaydebeapi连接需证书的MySQL JDBC服务器遇PKIX错误求助

我用Python的jaydebeapi库能正常建立非SSL连接到JDBC服务器，但连接强制要求证书的staging数据库时，不知道怎么正确提供MySQL JDBC所需的JKS文件。

环境依赖 #

python==3.9.16
JayDeBeApi==1.2.3
JPype1==1.4.1

现有代码 #

import jpype
import jaydebeapi

MYSQL_VJDBC_HOST = ""
MYSQL_VJDBC_JAR_PATH = ""
MYSQL_VJDBC_CERT_PATH = ""
MYSQL_VJDBC_CERT_PW = ""
MYSQL_VJDBC_SECRET = ""


def get_jdbc_connection(self):
    url = f"jdbc:vjdbc:servlet:{MYSQL_VJDBC_HOST}"
    jvm_path = jpype.getDefaultJVMPath()
    jpype.startJVM(
        jvm_path,
        f"-Djava.class.path={MYSQL_VJDBC_JAR_PATH}",
        f"-Djavax.net.ssl.trustStore={MYSQL_VJDBC_CERT_PATH}",
        f"-Djavax.net.ssl.trustStorePassword={MYSQL_VJDBC_CERT_PW}",
    )
    try:
        return jaydebeapi.connect(
            "de.simplicit.vjdbc.VirtualDriver",
            url,
            {
                "user": "mysql",
                "password": MYSQL_VJDBC_SECRET,
                "secure": "true",
                # "cert_file": sMYSQL_VJDBC_CERT_PATH,
                # "cert": MYSQL_VJDBC_CERT_PATH,
            },
            MYSQL_VJDBC_JAR_PATH,
        )
    except Exception as exception:
        print(f"There was an error connecting\n:{exception}")
        raise exception

报错信息 #

File "*/src/mysql_adapter.py", line 29, in get_jdbc_connection
return jaydebeapi.connect(
  File "*/.venv/lib/python3.9/site-packages/jaydebeapi/__init__.py", line 412, in connect
jconn = _jdbc_connect(jclassname, url, driver_args, jars, libs)
  File "*/.venv/lib/python3.9/site-packages/jaydebeapi/__init__.py", line 230, in _jdbc_connect_jpype
return jpype.java.sql.DriverManager.getConnection(url, *dargs)
  java.sql.java.sql.SQLException: java.sql.SQLException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

解决方法 #

这个报错是JVM无法信任目标服务器的证书，以下是几个可行的调整方案：

• 验证JKS文件有效性
  确认MYSQL_VJDBC_CERT_PATH指向的JKS文件存在、路径正确，且Python进程有读取权限。可以用Java自带的keytool工具验证密码和文件内容：

  keytool -list -keystore /path/to/your/cert.jks -storepass your_password
  

• 调整JVM启动参数顺序
  部分场景下，JVM参数顺序会影响生效，建议将SSL相关参数放在类路径参数之前：

  jpype.startJVM(
      jvm_path,
      f"-Djavax.net.ssl.trustStore={MYSQL_VJDBC_CERT_PATH}",
      f"-Djavax.net.ssl.trustStorePassword={MYSQL_VJDBC_CERT_PW}",
      f"-Djava.class.path={MYSQL_VJDBC_JAR_PATH}",
  )
  

• 在连接属性中补充SSL配置
  针对vjdbc驱动，尝试在连接参数里明确指定SSL相关属性：

  return jaydebeapi.connect(
      "de.simplicit.vjdbc.VirtualDriver",
      url,
      {
          "user": "mysql",
          "password": MYSQL_VJDBC_SECRET,
          "secure": "true",
          "ssl": "true",
          "trustStore": MYSQL_VJDBC_CERT_PATH,
          "trustStorePassword": MYSQL_VJDBC_CERT_PW
      },
      MYSQL_VJDBC_JAR_PATH,
  )
  

• 避免重复启动JVM
  如果该连接函数会被多次调用，重复启动JVM会引发异常，可添加判断逻辑：

  if not jpype.isJVMStarted():
      jpype.startJVM(...)
  

内容的提问来源于stack exchange，提问作者crowgers