诊断密码设置连接失败

elasticsearch-setup-passwords 命令通过发送用户管理 API 请求为内置用户设置密码。如果您的集群对 HTTP (REST) 接口使用了 SSL/TLS，则该命令会尝试使用 HTTPS 协议建立连接。如果连接尝试失败，该命令也会失败。

症状

1. Elasticsearch 正在运行 HTTPS，但该命令无法检测到它，并返回以下错误

   Cannot connect to elasticsearch node.
   java.net.SocketException: Unexpected end of file from server
   ...
   ERROR: Failed to connect to elasticsearch at
   http://127.0.0.1:9200/_security/_authenticate?pretty.
   Is the URL correct and elasticsearch running?
   		

2. 已配置 SSL/TLS，但无法建立信任关系。该命令返回以下错误

   SSL connection to
   https://127.0.0.1:9200/_security/_authenticate?pretty
   failed: sun.security.validator.ValidatorException:
   PKIX path building failed:
   sun.security.provider.certpath.SunCertPathBuilderException:
   unable to find valid certification path to requested target
   Check the elasticsearch SSL settings under
   xpack.security.http.ssl.
   ...
   ERROR: Failed to establish SSL connection to elasticsearch at
   https://127.0.0.1:9200/_security/_authenticate?pretty.
   		

3. 命令失败是因为主机名验证失败，这会导致以下错误

   SSL connection to
   https://idp.localhost.test:9200/_security/_authenticate?pretty
   failed: java.security.cert.CertificateException:
   No subject alternative DNS name matching
   elasticsearch.example.com found.
   Check the elasticsearch SSL settings under
   xpack.security.http.ssl.
   ...
   ERROR: Failed to establish SSL connection to elasticsearch at
   <ELASTICSEARCH_HOST_URL>:9200/_security/_authenticate?pretty.
   		

解决方法

1. 如果您的集群为 HTTP 接口使用了 TLS/SSL，但 elasticsearch-setup-passwords 命令尝试建立非安全连接，请使用 --url 命令选项显式指定 HTTPS URL。或者，将 xpack.security.http.ssl.enabled 设置设置为 true。
2. 如果该命令不信任 Elasticsearch 服务器，请验证您是否配置了 xpack.security.http.ssl.certificate_authorities 设置或 xpack.security.http.ssl.truststore.path 设置。
3. 如果主机名验证失败，您可以通过将 xpack.security.http.ssl.verification_mode 设置为 certificate 来禁用此验证。

有关这些设置的更多信息，请参阅 安全设置。