elasticsearch配置x-pack和SSL安全认证常见问题

最新推荐文章于 2026-06-21 09:00:04 发布

原创最新推荐文章于 2026-06-21 09:00:04 发布 · 1.8w 阅读

3 ·

本内容遵循CC 4.0 BY-SA版权协议

标签

#sublime text #mozilla #entity #视频处理 #cloud

本文详细介绍了在配置Elasticsearch的X-Pack和SSL安全认证过程中遇到的异常情况，针对rest-high-level-client和transport两种客户端类型，分别提供了相应的解决方案，确保客户端与服务端的安全连接。

精选30+云产品，助力企业轻松上云！>>>

异常

当客户端为rest-high-level-client时，客户端异常：

com.mamaqunaer.elasticsearch.ElasticSearchException: org.apache.http.ConnectionClosedException: Connection closed

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.springframework.test.context.junit4.statements.RunBeforeTestExecutionCallbacks.evaluate(RunBeforeTestExecutionCallbacks.java:73)
	at org.springframework.test.context.junit4.statements.RunAfterTestExecutionCallbacks.evaluate(RunAfterTestExecutionCallbacks.java:83)
	at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:75)
	at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:86)
	at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:84)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:251)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:97)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
	at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
	at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:70)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
	at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:190)
	at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
	at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:68)
	at com.intellij.rt.execution.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:47)
	at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:242)
	at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:70)
Caused by: org.apache.http.ConnectionClosedException: Connection closed
	at org.elasticsearch.client.RestClient$SyncResponseListener.get(RestClient.java:718)
	at org.elasticsearch.client.RestClient.performRequest(RestClient.java:235)
	at org.elasticsearch.client.RestClient.performRequest(RestClient.java:198)
	at org.elasticsearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:522)
	at org.elasticsearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:508)
	at org.elasticsearch.client.RestHighLevelClient.get(RestHighLevelClient.java:293)
	... 34 more
Caused by: org.apache.http.ConnectionClosedException: Connection closed
	at org.apache.http.nio.protocol.HttpAsyncRequestExecutor.endOfInput(HttpAsyncRequestExecutor.java:350)
	at org.apache.http.impl.nio.client.InternalRequestExecutor.endOfInput(InternalRequestExecutor.java:132)
	at org.apache.http.impl.nio.DefaultNHttpClientConnection.consumeInput(DefaultNHttpClientConnection.java:261)
	at org.apache.http.impl.nio.client.InternalIODispatch.onInputReady(InternalIODispatch.java:81)
	at org.apache.http.impl.nio.client.InternalIODispatch.onInputReady(InternalIODispatch.java:39)
	at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:114)
	at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:162)
	at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:337)
	at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:315)
	at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:276)
	at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:104)
	at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:588)
	at java.lang.Thread.run(Thread.java:745)
	Suppressed: org.apache.http.ConnectionClosedException: Connection closed
		... 13 more


Process finished with exit code 255

当客户端为rest-high-level-client时，服务端异常：

[2019-11-16T14:03:29,754][WARN ][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [node-1] caught exception while handling client http traffic, closing connection [id: 0x0eeb7730, L:0.0.0.0/0.0.0.0:9200 ! R:/127.0.0.1:60934]
io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 474554202f6974656d2f6974656d2f383030303336383420485454502f312e310d0a436f6e74656e742d4c656e6774683a20300d0a486f73743a203132372e302e302e313a393230300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a557365722d4167656e743a204170616368652d487474704173796e63436c69656e742f342e312e3320284a6176612f312e382e305f3932290d0a417574686f72697a6174696f6e3a204261736963205a57786863335270597a6f784d6a4d304e54593d0d0a0d0a
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) [netty-transport-4.1.16.Final.jar:4.1.16.Final]

当客户端为transport时，客户端异常：

org.elasticsearch.transport.ConnectTransportException: [][127.0.0.1:9300] general node connection failure
	at org.elasticsearch.transport.TcpTransport.openConnection(TcpTransport.java:676) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.transport.TcpTransport.openConnection(TcpTransport.java:123) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.transport.TransportService.openConnection(TransportService.java:350) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.client.transport.TransportClientNodesService$SimpleNodeSampler.doSample(TransportClientNodesService.java:407) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.client.transport.TransportClientNodesService$NodeSampler.sample(TransportClientNodesService.java:357) [elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.client.transport.TransportClientNodesService.addTransportAddresses(TransportClientNodesService.java:198) [elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.client.transport.TransportClient.addTransportAddress(TransportClient.java:334) [elasticsearch-6.3.0.jar:6.3.0]
···
···
Caused by: java.lang.IllegalStateException: handshake failed
	at org.elasticsearch.transport.TcpTransport.executeHandshake(TcpTransport.java:1667) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.transport.TcpTransport.openConnection(TcpTransport.java:642) ~[elasticsearch-6.3.0.jar:6.3.0]
	... 43 common frames omitted
Caused by: org.elasticsearch.transport.TransportException: connection reset
	at org.elasticsearch.transport.TcpTransport.cancelHandshakeForChannel(TcpTransport.java:1709) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.transport.TcpTransport.lambda$openConnection$12(TcpTransport.java:639) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.action.ActionListener.lambda$wrap$0(ActionListener.java:82) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.action.ActionListener$1.onResponse(ActionListener.java:60) ~[elasticsearch-6.3.0.jar:6.3.0]
	at org.elasticsearch.action.ActionListener.lambda$toBiConsumer$2(ActionListener.java:96) ~[elasticsearch-6.3.0.jar:6.3.0]
	at java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:760) ~[na:1.8.0_92]
	at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:736) ~[na:1.8.0_92]
	at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:474) ~[na:1.8.0_92]
	at java.util.concurrent.CompletableFuture.complete(CompletableFuture.java:1962) ~[na:1.8.0_92]
	at org.elasticsearch.transport.netty4.NettyTcpChannel.lambda$new$0(NettyTcpChannel.java:47) ~[transport-netty4-client-6.3.0.jar:6.3.0]
	at io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:511) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:504) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:483) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:424) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.util.concurrent.DefaultPromise.trySuccess(DefaultPromise.java:103) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.DefaultChannelPromise.trySuccess(DefaultChannelPromise.java:84) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.AbstractChannel$CloseFuture.setClosed(AbstractChannel.java:1148) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.AbstractChannel$AbstractUnsafe.doClose0(AbstractChannel.java:764) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.AbstractChannel$AbstractUnsafe.close(AbstractChannel.java:740) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.AbstractChannel$AbstractUnsafe.close(AbstractChannel.java:611) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.closeOnRead(AbstractNioByteChannel.java:105) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:171) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:646) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:546) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:500) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:460) ~[netty-transport-4.1.27.Final.jar:4.1.27.Final]
	at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884) ~[netty-common-4.1.27.Final.jar:4.1.27.Final]
	at java.lang.Thread.run(Thread.java:745) ~[na:1.8.0_92]
···
···
NoNodeAvailableException[None of the configured nodes are available: [{#transport#-1}{GRYd5RlYSquKxqKj-Of9gw}{127.0.0.1}{127.0.0.1:9300}, {#transport#-2}{8JKqHBmARb2gR6YdjMynKg}{127.0.0.1}{127.0.0.1:9301}]
]
	at org.elasticsearch.client.transport.TransportClientNodesService.ensureNodesAreAvailable(TransportClientNodesService.java:347)
	at org.elasticsearch.client.transport.TransportClientNodesService.execute(TransportClientNodesService.java:245)
	at org.elasticsearch.client.transport.TransportProxyClient.execute(TransportProxyClient.java:60)
	at org.elasticsearch.client.transport.TransportClient.doExecute(TransportClient.java:378)
	at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:405)
	at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:394)
	at org.elasticsearch.action.ActionRequestBuilder.execute(ActionRequestBuilder.java:46)
	at org.elasticsearch.action.ActionRequestBuilder.get(ActionRequestBuilder.java:53)

当客户端为transport时，服务端异常：

[2019-11-16T14:13:04,859][WARN ][o.e.x.s.t.n.SecurityNetty4ServerTransport] [node-1] exception caught on transport layer [NettyTcpChannel{localAddress=0.0.0.0/0.0.0.0:9300, remoteAddress=/127.0.0.1:61256}], closing connection
io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 455300000050000000000000000108004d3603010d417574686f72697a6174696f6e1a4261736963205a57786863335270597a6f784d6a4d304e54593d0016696e7465726e616c3a7463702f68616e647368616b6500
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:459) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265) ~[netty-codec-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1359) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:935) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:134) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:545) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-transport-4.1.16.Final.jar:4.1.16.Final]
	at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-common-4.1.16.Final.jar:4.1.16.Final]
	at java.lang.Thread.run(Thread.java:745) [?:1.8.0_92]
Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 455300000050000000000000000108004d3603010d417574686f72697a6174696f6e1a4261736963205a57786863335270597a6f784d6a4d304e54593d0016696e7465726e616c3a7463702f68616e647368616b6500
	at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1106) ~[?:?]
	at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1162) ~[?:?]
	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:489) ~[?:?]
	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:428) ~[?:?]
	... 15 more

解决方案

客户端是rest-high-level-client时

只需要配置settings参数（和服务端保持一致即可）

# 使用ssl时：
#es:
#  settings: {cluster.name: elasticsearch, xpack.security.user: 'elastic:123456', xpack.security.transport.ssl.enabled: true, xpack.security.transport.ssl.verification_mode: certificate, xpack.security.transport.ssl.keystore.path: '/Users/wangnan/workspace/es/es-spring-boot-starter/src/test/resources/certs/elastic-certificates.p12', xpack.security.transport.ssl.truststore.path: '/Users/wangnan/workspace/es/es-spring-boot-starter/src/test/resources/certs/elastic-certificates.p12'}
#  type: TRANSPORT
#  clusters:
#  - 127.0.0.1:9300
#  - 127.0.0.1:9301

# 不使用ssl时：
#es:
#  settings: {cluster.name: elasticsearch, xpack.security.user: 'elastic:123456'}
#  type: TRANSPORT
#  clusters:
#  - 127.0.0.1:9300
#  - 127.0.0.1:9301

客户端是transport时

配置文件：

# 使用ssl验证时
#es:
#  settings: {cluster.name: elasticsearch, xpack.security.user: 'elastic:123456', xpack.security.http.ssl.enabled: true, xpack.security.http.ssl.keystore.path: '/Users/wangnan/workspace/es/es-spring-boot-starter/src/test/resources/certs/elastic-certificates.p12', xpack.security.http.ssl.truststore.path: '/Users/wangnan/workspace/es/es-spring-boot-starter/src/test/resources/certs/elastic-certificates.p12'}
#  type: REST_HIGH_LEVEL
#  clusters:
#  - 127.0.0.1:9200
#  - 127.0.0.1:9201

# 不使用ssl验证时
es:
  settings: {cluster.name: elasticsearch, xpack.security.user: 'elastic:123456'}
  type: REST_HIGH_LEVEL
  clusters:
  - 127.0.0.1:9200
  - 127.0.0.1:9201

另外，java代码：

package com.caiya.elasticsearch.core;

import org.apache.commons.collections4.MapUtils;
import org.apache.http.HttpHost;
import org.apache.http.auth.AuthScope;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.CredentialsProvider;
import org.apache.http.impl.client.BasicCredentialsProvider;
import org.apache.http.ssl.SSLContextBuilder;
import org.apache.http.ssl.SSLContexts;
import org.elasticsearch.client.RestClient;
import org.elasticsearch.client.RestHighLevelClient;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.net.ssl.SSLContext;
import java.io.InputStream;
import java.nio.file.FileSystems;
import java.nio.file.Files;
import java.security.KeyStore;
import java.util.List;
import java.util.Map;
import java.util.Objects;

/**
 * Rest es client builder.
 *
 * @author wangnan
 * @since 1.0
 */
public final class RestElasticSearchClientBuilder {

    private static final Logger logger = LoggerFactory.getLogger(RestElasticSearchClientBuilder.class);

    private RestHighLevelClient client;

    private String refreshPolicy = "false";

    private boolean refresh = false;

    private static boolean isSslEnabled(Map<String, String> settings) {
        return settings != null && settings.containsKey("xpack.security.http.ssl.enabled") && Objects.equals("true", settings.get("xpack.security.http.ssl.enabled"));
    }

    public static RestElasticSearchClientBuilder create(List<String> clusters, Map<String, String> settings) {
        String schema = isSslEnabled(settings) ? "https" : HttpHost.DEFAULT_SCHEME_NAME;
        return new RestElasticSearchClientBuilder()
                .clustersAndSchema(clusters, schema, settings);
    }

    private RestElasticSearchClientBuilder clustersAndSchema(List<String> clusters, String schema, Map<String, String> settings) {
        try {
            HttpHost[] httpHosts = new HttpHost[clusters.size()];
            int index = 0;
            for (String cluster : clusters) {
                httpHosts[index++] = new HttpHost(cluster.split(":")[0], Integer.parseInt(cluster.split(":")[1]), schema);
            }

            SSLContext sslContext = null;
            if (isSslEnabled(settings)) {
                KeyStore truststore = KeyStore.getInstance("jks");
                try (InputStream is = Files.newInputStream(FileSystems.getDefault().getPath(settings.get("xpack.security.http.ssl.keystore.path")))) {
                    truststore.load(is, settings.containsKey("xpack.security.http.ssl.keystore.password") ? settings.get("xpack.security.http.ssl.keystore.path").toCharArray() : "".toCharArray());
                    SSLContextBuilder sslBuilder = SSLContexts.custom().loadTrustMaterial(truststore, null);
                    sslContext = sslBuilder.build();
                }
            }

            final SSLContext immutableSslContext = sslContext;
            this.client = new RestHighLevelClient(RestClient.builder(httpHosts).setHttpClientConfigCallback(httpClientBuilder -> {
                CredentialsProvider credentialsProvider = new BasicCredentialsProvider();

                if (MapUtils.isNotEmpty(settings) && settings.containsKey(ElasticSearchConstant.XPACK_AUTH_SETTING)) {
                    credentialsProvider.setCredentials(AuthScope.ANY,
                            new UsernamePasswordCredentials(settings.get(ElasticSearchConstant.XPACK_AUTH_SETTING).split(":")[0],
                                    settings.get(ElasticSearchConstant.XPACK_AUTH_SETTING).split(":")[1]));
                }
                httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);

                if (isSslEnabled(settings)) {
                    httpClientBuilder.setSSLContext(immutableSslContext).setSSLHostnameVerifier((s, sslSession) -> true);
                }

                return httpClientBuilder;
            }));
        } catch (Exception e) {
            logger.error("elasticsearch rest client init failed", e);
            if (client != null) {
                try {
                    client.close();
                    client = null;// help gc
                } catch (Exception e1) {
                    logger.error("elasticsearch rest client close failed", e);
                }
            }
        }
        return this;
    }

    public RestElasticSearchClientBuilder setRefreshPolicy(String refreshPolicy) {
        this.refreshPolicy = (refreshPolicy == null) ? "" : refreshPolicy;
        return this;
    }

    public RestElasticSearchClientBuilder setRefresh(boolean refresh) {
        this.refresh = refresh;
        return this;
    }

    public RestElasticSearchClient build() {
        return buildWithClientName(null);
    }

    public RestElasticSearchClient buildWithClientName(String name) {
        if (client == null) {
            logger.error("rest client cannot be null");
            throw new IllegalArgumentException("rest client cannot be null");
        }

        RestElasticSearchClient restElasticSearchClient = new RestElasticSearchClient(client);
        restElasticSearchClient.setName(name);
        restElasticSearchClient.setRefreshPolicy(refreshPolicy);
        restElasticSearchClient.setRefresh(refresh);
        return restElasticSearchClient;
    }

    /**
     * @return elasticsearch low-level client
     * @see <a href="https://www.elastic.co/guide/en/elasticsearch/client/java-rest/current/java-rest-low-usage-requests.html"/>low-level client usage</a>
     */
    public RestClient buildOriginalLowLevelClient() {
        if (client == null) {
            logger.error("rest client cannot be null");
            throw new IllegalArgumentException("rest client cannot be null");
        }

        return client.getLowLevelClient();
    }


}

参考资料

Security overview:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/elasticsearch-security.html

License management:
https://www.elastic.co/guide/en/elastic-stack-overview/6.3/license-management.html
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/get-trial-status.html
Licensing APIs:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/licensing-apis.html

Configuring security in Elasticsearch:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/configuring-security.html

Setting Up TLS on a Cluster:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/ssl-tls.html

Encrypting communications in Elasticsearch:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/configuring-tls.html#configuring-tls

Security settings in Elasticsearch:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/security-settings.html

Java client and security:
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/java-clients.html
Encrypted communication:
https://www.elastic.co/guide/en/elasticsearch/client/java-rest/6.3/_encrypted_communication.html