使用弹性 R 包中的自签名证书连接到安全弹性搜索

Question

我是运行一个 Elastic Search 实例，通过创建自签名证书使用 SSL。当通过 elastic 包从 R 连接时，我运行遇到了问题。这就是我的进步：

启用 SSL 后，当我尝试连接到 Elastic Search 实例时，出现以下错误：

$ curl -u $USER:$PASS 'https://localhost:9200/_cat/health?v'
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

很明显，这个问题是因为证书不被信任。一种方法是将自签名证书添加到信任库，但我不知道它在哪里。另一种方法是通过添加 -k 跳过证书验证。但我想表演它。因此，我找到了一种解决方法，只需指定 root-ca.pem 如下：

$ curl -u $USER:$PASS 'https://localhost:9200/_cat/health?v' --cacert /home/user/root-ca.pem
epoch      timestamp cluster     status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1479462058 03:40:58  es-cluster yellow          1         1    365 365    0    0      364             0                  -                 50.1%

然后另一个 SO 问题帮助我创建了一个文件 ~/.curlrc 如下：

$ cat ~/.curlrc
capath=/home/user/

在那之后，我什至不必指定证书。

$ curl -u $USER:$PASS 'https://localhost:9200/_cat/health?v'
epoch      timestamp cluster     status node.total node.data shards pri relo init unassign pending_tasks max_task_wait_time active_shards_percent
1479462172 03:42:52  es-cluster yellow          1         1    365 365    0    0      364             0                  -                 50.1%

到现在为止都很好，但是现在当我尝试从 R 连接到 Elastic Search 时。我收到以下错误。

> library(elastic)
> connect(es_base = "https://localhost", es_port = 9200, es_user = USER,   es_pwd = PASS)
Error:
  Failed to connect to https://127.0.0.1:9200
  Remember to start Elasticsearch before connecting

日志报告 unknown_ca 错误。 elastic R 包可能使用 httr/curl 来建立连接，但我不知道如何指定证书。我提到了解决方案 here 但它适用于 RCurl.

求推荐。

版本：

R : 3.3.1
R（弹性包）：0.7.8
弹性搜索：2.4.1
OS：RHEL 6.7

Answer 1

根据@sckott 的建议，我必须设置 cainfo 参数。以下是我的案例：

library(elastic)
library(httr)
set_config(config(cainfo = "/home/user/root-ca.pem"))
connect(es_base = "https://localhost", es_port = 9200, es_user = USER,   es_pwd = PASS)

谢谢斯科特。

使用弹性 R 包中的自签名证书连接到安全弹性搜索

Connect to Secured Elastic Search with self-signed certificate from elastic R package

curl

r

elasticsearch

ropensci