WSO2 EI 6.6.0更换证书后wso2carbon.log持续报连接拒绝错误求助

环境信息 #

• WSO2 EI 6.6.0
• CentOS 7.8
• MySQL

已执行的证书更新步骤 #

openssl pkcs12 -export -in newcert.crt -inkey mydomain.key -name "mydomain-2022" -out mydomain-2022.pfx
keytool -importkeystore -srckeystore mydomain-2022.pfx -srcstoretype pkcs12 -destkeystore 2022.jks -deststoretype JKS
keytool -export -alias "mydomain-2022" -keystore 2022.jks -file 2022.pem
keytool -import -alias mydomain-2022 -file 2022.pem -keystore client-truststore.jks -storepass wso2carbon

将以下文件中的2021.jks全部替换为2022.jks：

• /usr/lib64/wso2/wso2ei/6.6.0/conf/axis2/axis2.xml
• /usr/lib64/wso2/wso2ei/6.6.0/conf/tomcat/catalina-server.xml
• /usr/lib64/wso2/wso2ei/6.6.0/wso2/analytics/conf/dashboard/deployment-mysql.yaml
• /usr/lib64/wso2/wso2ei/6.6.0/wso2/analytics/conf/dashboard/deployment.yaml
• /usr/lib64/wso2/wso2ei/6.6.0/wso2/analytics/conf/manager/deployment.yaml
• /usr/lib64/wso2/wso2ei/6.6.0/wso2/analytics/conf/worker/deployment.yaml

完成后重启服务，新证书已生效，服务可正常访问https://esb.mydomain.com:9443/carbon/admin/login.jsp，但wso2carbon.log每分钟生成以下警告/错误：

TID: [-1] [] [2022-10-12 21:03:12,351]  WARN {org.wso2.carbon.databridge.agent.endpoint.DataEndpointGroup} - No receiver is reachable at reconnection, will try to reconnect every 30 sec
TID: [-1] [] [2022-10-12 21:03:12,354] ERROR {org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker} - Error while trying to connect to the endpoint. Cannot borrow client for ssl://localhost:7712 org.wso2.carbon.databridge.agent.exception.DataEndpointAuthenticationException: Cannot borrow client for ssl://localhost:7712
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:147)
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.run(DataEndpointConnectionWorker.java:59)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: org.wso2.carbon.databridge.agent.exception.DataEndpointSecurityException: Error while trying to connect to ssl://localhost:7712
        at org.wso2.carbon.databridge.agent.endpoint.thrift.ThriftSecureClientPoolFactory.createClient(ThriftSecureClientPoolFactory.java:81)
        at org.wso2.carbon.databridge.agent.client.AbstractClientPoolFactory.makeObject(AbstractClientPoolFactory.java:39)
        at org.apache.commons.pool.impl.GenericKeyedObjectPool.borrowObject(GenericKeyedObjectPool.java:1212)
        at org.wso2.carbon.databridge.agent.endpoint.DataEndpointConnectionWorker.connect(DataEndpointConnectionWorker.java:137)
        ... 6 more
Caused by: org.apache.thrift.transport.TTransportException: Could not connect to localhost on port 7712
        at org.apache.thrift.transport.TSSLTransportFactory.createClient(TSSLTransportFactory.java:237)
        at org.apache.thrift.transport.TSSLTransportFactory.getClientSocket(TSSLTransportFactory.java:169)
        at org.wso2.carbon.databridge.agent.endpoint.thrift.ThriftSecureClientPoolFactory.createClient(ThriftSecureClientPoolFactory.java:64)
        ... 9 more
Caused by: java.net.ConnectException: Connection refused (Connection refused)
        at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
        at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:399)
        at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:242)
        at java.base/java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:224)
        at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:403)
        at java.base/java.net.Socket.connect(Socket.java:609)
        at java.base/sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:285)
        at java.base/sun.security.ssl.SSLSocketImpl.<init>(SSLSocketImpl.java:144)
        at java.base/sun.security.ssl.SSLSocketFactoryImpl.createSocket(SSLSocketFactoryImpl.java:88)
        at org.apache.thrift.transport.TSSLTransportFactory.createClient(TSSLTransportFactory.java:233)
        ... 11 more

解决建议 #

1. 检查Analytics Worker服务状态 #

端口7712是WSO2 Analytics Worker的Thrift安全监听端口，先确认Worker进程是否正常运行：

# 查找Worker进程
ps aux | grep wso2ei-worker
# 检查端口监听状态
netstat -tulpn | grep 7712

如果Worker未启动，手动启动服务：

cd /usr/lib64/wso2/wso2ei/6.6.0/bin/
./worker.sh start

2. 验证Analytics Worker的证书配置 #

检查Worker的密钥库/信任库配置是否指向新证书：
编辑/usr/lib64/wso2/wso2ei/6.6.0/wso2/analytics/conf/worker/deployment.yaml，确认以下配置项：

wso2.transport.thrift:
  listener:
    - id: "ThriftDataListener"
      host: "0.0.0.0"
      port: 7712
      sslEnabled: true
      keyStoreFile: "${carbon.home}/resources/security/2022.jks"
      keyStorePassword: "wso2carbon"
      trustStoreFile: "${carbon.home}/resources/security/client-truststore.jks"
      trustStorePassword: "wso2carbon"

确保新证书已正确导入Worker的信任库，且别名与配置一致。

3. 检查主节点到Worker的连接配置 #

编辑主节点的/usr/lib64/wso2/wso2ei/6.6.0/conf/axis2/axis2.xml，确认DataBridge端点地址正确（若Worker部署在远程服务器，需将localhost替换为实际IP）：

<parameter name="dataEndpoints">ssl://localhost:7712,ssl://localhost:7713</parameter>

4. 防火墙端口开放检查 #

确认CentOS防火墙允许7712端口的入站连接：

firewall-cmd --add-port=7712/tcp --permanent
firewall-cmd --reload

若Worker为远程部署，用以下命令测试网络连通性：

nc -zv <worker-ip> 7712

5. 禁用不必要的监控（若无需Analytics功能） #

如果不使用WSO2 Analytics，可直接禁用DataBridge代理以消除错误日志：
编辑/usr/lib64/wso2/wso2ei/6.6.0/conf/axis2/axis2.xml，注释或删除以下配置块：

<transportSender name="databridge" class="org.wso2.carbon.databridge.agent.endpoint.DataBridgeSender">
    <parameter name="dataEndpoints">ssl://localhost:7712,ssl://localhost:7713</parameter>
    <parameter name="enable">true</parameter>
</transportSender>

完成后重启主服务。

内容的提问来源于stack exchange，提问作者user36814