PostgreSQL SSL配置报错：PBES2 SecretKeyFactory not available 求助

问题背景 #

搭建启用SSL的本地PostgreSQL实例，使用OpenSSL生成带密码的密钥后，通过IntelliJ的PostgreSQL JDBC驱动连接时触发如下错误：

DBMS: PostgreSQL (ver. 15.2 (Debian 15.2-1.pgdg110+1))  Case sensitivity: plain=lower, delimited=exact Driver: PostgreSQL JDBC Driver (ver. 42.5.0, JDBC4.2)

java.io.IOException: JCE error: PBES2 SecretKeyFactory not available.

环境配置信息 #

OpenSSL证书生成脚本 #

CERT_LOC=certs
PSQL_CONF_LOC=resources/psql.conf
ENCRYPT_PASSWD=resources/psql_ssl_pwd

rm certs/*

echo "generating postgresql.key"
openssl genpkey -quiet -algorithm rsa -out $CERT_LOC/postgresql.key -outform pem  # -aes256
echo "generating postgresql.cert"
openssl req -new -key $CERT_LOC/postgresql.key -days 365 -out $CERT_LOC/postgresql.cert -x509 -config $PSQL_CONF_LOC
echo "generating postgresql.pk8"
openssl pkcs8 -topk8 -inform PEM -in $CERT_LOC/postgresql.key -outform DER -out $CERT_LOC/postgresql.pk8 -v2 aes256 -passout file:$ENCRYPT_PASSWD  # -nocrypt
echo "all 3 done"

PSQL_CONF配置 #

[ req ]
default_bits                    = 2048
default_md                      = sha256
prompt                          = no
encrypt_key                     = yes
distinguished_name              = req_distinguished_name

[ req_distinguished_name ]
countryName                     = AA
stateOrProvinceName             = AAAAA
localityName                    = AAAAA
organizationName                = AAAAAAAAAA
commonName                      = some.dns.common.name.local

postgresql.conf SSL配置 #

## SSL CONFIG
ssl = on
ssl_ca_file = '/opt/postgresql/root.crt'
ssl_cert_file = '/opt/postgresql/tls.crt'
ssl_key_file = '/opt/postgresql/tls.key'
ssl_passphrase_command = 'SOMEPASSWORDISET'
ssl_prefer_server_ciphers = on
ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers

pg_hba.conf配置 #

# TYPE  DATABASE        USER            ADDRESS                 METHOD
local   all             all                                     scram-sha-256     # "local" is for Unix domain socket connections only
host    all             all             127.0.0.1/32            scram-sha-256     # IPv4 local connections:
host    all             all             ::1/128                 scram-sha-256     # IPv6 local connections:
local   replication     all                                     scram-sha-256
#host    replication     all             127.0.0.1/32            scram-sha-256
#host    replication     all             ::1/128                 scram-sha-256
hostssl all             all             0.0.0.0/0               scram-sha-256 clientcert=verify-ca      # IPv4 remote connections for authenticated users
hostssl all             all             ::/0                    scram-sha-256 clientcert=verify-ca      # IPv6 remote connections for authenticated users

已尝试操作 #

生成pk8密钥时添加-nocrypt参数，配置后PostgreSQL可正常启动且能通过IntelliJ连接，但密钥无密码保护，不符合安全需求。

解决方案 #

原因分析 #

错误PBES2 SecretKeyFactory not available是因为JDBC驱动无法识别OpenSSL默认生成的PBES2加密格式密钥，或JDK缺少对应加密算法的支持。

解决步骤 #

1. 调整OpenSSL密钥加密算法
   修改pk8密钥生成命令，使用JDBC兼容的PBKDF2算法：

   openssl pkcs8 -topk8 -inform PEM -in $CERT_LOC/postgresql.key -outform DER -out $CERT_LOC/postgresql.pk8 -v2 pbkdf2 -v2prf hmacsha256 -passout file:$ENCRYPT_PASSWD
   

   通过指定-v2 pbkdf2和-v2prf hmacsha256，确保密钥格式能被JDBC驱动正确解析。

2. 启用JDK无限制加密策略
   检查JDK配置，确保启用无限制强度加密策略：

   • 打开$JAVA_HOME/jre/lib/security/java.security文件
   • 找到crypto.policy配置项，设置为crypto.policy=unlimited
   • 重启IntelliJ或相关服务

3. 验证密钥与连接配置

   • 将新生成的postgresql.pk8替换到ssl_key_file指定路径，重启PostgreSQL服务
   • 在IntelliJ数据库连接配置中补充参数：

     sslmode=verify-ca
     sslpassword=你的密钥密码
     

     或直接在JDBC URL中加入：

     jdbc:postgresql://localhost:5432/your_db?sslmode=verify-ca&sslpassword=your_password
     

内容的提问来源于stack exchange，提问作者jake wong