1

I want to use the Java REST API (RestHighLevelClient) to communicate with an Elasticsearch 5.6 server over HTTPS. However, the certificate for the server is self signed and when I try to connect it throws a SSLHandshakeException.

Is there a way of configuring the REST client to accept self signed certificates?

James Baker
  • 1,143
  • 17
  • 39

1 Answers1

5

I got this working using a custom Java Key Store. Here's my code:

CredentialsProvider credentialsProvider = new BasicCredentialsProvider(); credentialsProvider.setCredentials(AuthScope.ANY, new UsernamePasswordCredentials(username, password));

final SSLContext sslContext = SSLContexts.custom()
        .loadTrustMaterial(new File("my_keystore.jks"), keystorePassword.toCharArray(),
            new TrustSelfSignedStrategy())
        .build();


RestClient client = RestClient.builder(new HttpHost(host, port, scheme)).setHttpClientConfigCallback(httpClientBuilder -> httpClientBuilder
        .setDefaultCredentialsProvider(credentialsProvider)
        .setSSLContext(sslContext)
).build();

To create the keystore, I downloaded the cert for the domain through Firefox, and used:

keytool -import -v -trustcacerts -file my_domain.crt -keystore my_keystore.jks -keypass password -storepass password
James Baker
  • 1,143
  • 17
  • 39
  • Using your own keystore is indeed recommended. You could use the standard Java runtime cacerts file too and then you don't need the custom SSLContext, but that file gets overwritten with each runtime update. – Gimby Nov 17 '17 at 08:48