Configuring JanusGraph with ElasticSearch using a self-signed certificate

[dwolfson]

I'm trying to configure JanusGraph 0.53 with Hbase and ElasticSearch 7.9.3. ElasticSearch is configured with SSL and using a self-signed certificate. My JanusGraph configuration includes:

 ```

"storage.backend": "hbase",
"storage.hostname": "myHbase",
"storage.port": "2181",
"storage.hbase.skip-schema-check": "false",
"storage.hbase.table": "myTable",
"index.search.backend": "elasticsearch",
"index.search.elasticsearch.connect-timeout": "2000",
"index.search.hostname": "qqq",
"index.search.elasticsearch.ssl.disable-hostname-verification":"true",
"index.search.elasticsearch.http.auth.type": "basic",
"index.search.elasticsearch.http.auth.basic.username": "xxx",
"index.search.elasticsearch.http.auth.basic.password": "yyy",
"index.search.elasticsearch.ssl.allow-self-signed-certificates": "true",
"index.search.elasticsearch.ssl.enabled": "true",
"index.search.elasticsearch.interface": "REST_CLIENT",
"index.search.elasticsearch.client-only": "true",

I can use curl -k and successfully communicate with ElasticSearch from my client machine. But when I use the configuration above, it does not appear to be disabling certificate verification and the error that I get is:

...
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:242)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:113)
at org.apache.http.ssl.SSLContextBuilder$TrustManagerDelegate.checkServerTrusted(SSLContextBuilder.java:413)
at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1455)
at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
... 19 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:127)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)

...

It does not appear to be disabling certificate validation...

Any suggestions would be greatly appreciated...

[dwolfson]

Well - I turned on more logging and noticed that what seems to be happening is different. It appears that the host setting in the configuration is being ignored and JanusGraph is always trying to connect to ES on localhost...I'm not sure how/why that is happening?

Thoughts?

[jianhuang1648678534]

did you have port information for index.search.hostname
index.search.hostname=xxxxx:9200

[dwolfson]

Yes - I just redacted it for the note (noted as "qqq" above.

To add to the weirdness, I count that if I use a different Elastic Search instance it works. I have no idea what could be different between two instances of the same Elastic Search cloud service.

[porunov]

Port must be specified via the configuration option:
index.[X].port
In your case it’s: ‘index.search.port=9200’

[dwolfson]

Thank you, yes - I have use both xxx:9200 in the hostname and also separately set the port without the port appended to the hostname. Doesn't seem to be much difference between those approaches?