opensearch-project / opensearch-project/opensearch-java
[FEATURE] Add example of ignoring certificate validation when using local docker container
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 165
- Forks
- 250
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 26
Description
Is your feature request related to a problem?
Docker compose launches OpenSearch using https with self signed cert. Example code only shows how to specify a trust store but didn't show how to disable the verification on client side (for local testing).
- Demo cert from https://github.com/opensearch-project/security/blob/207cfcc379ffd4127e32b9fdfdd75ea394b48d0e/tools/install_demo_configuration.sh#L201
- Example error
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.opensearch.client.RestClient.extractAndWrapCause(RestClient.java:902)
at org.opensearch.client.RestClient.performRequest(RestClient.java:301)
at org.opensearch.client.RestClient.performRequest(RestClient.java:289)
at org.opensearch.client.RestHighLevelClient.internalPerformRequest(RestHighLevelClient.java:1762)
at org.opensearch.client.RestHighLevelClient.performRequest(RestHighLevelClient.java:1745)
at org.opensearch.client.RestHighLevelClient.performRequestAndParseEntity(RestHighLevelClient.java:1709)
at org.opensearch.client.IndicesClient.create(IndicesClient.java:160)
What solution would you like?
Tell people how to disable the certificate verification (if they know what they are doing) https://opensearch.org/docs/latest/clients/java/. I am not sure if there is a doc repo Maybe I should create the issue in https://github.com/opensearch-project/documentation-website/issues instead?
RestHighLevelClient client = new RestHighLevelClient(RestClient.builder(HttpHost.create("https://localhost:9200"))
.setHttpClientConfigCallback((c) -> {
// Disable cert verification
// https://stackoverflow.com/questions/2703161/how-to-ignore-ssl-certificate-errors-in-apache-httpclient-4-0
// because default uses a demo cert from https://github.com/opensearch-project/security/blob/207cfcc379ffd4127e32b9fdfdd75ea394b48d0e/tools/install_demo_configuration.sh#L201
try {
c.setSSLContext(new SSLContextBuilder().loadTrustMaterial(null, TrustAllStrategy.INSTANCE).build())
.setSSLHostnameVerifier(new NoopHostnameVerifier());
} catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
throw new RuntimeException(e);
}
return c.setDefaultCredentialsProvider(credentialsProvider);
}));
What alternatives have you considered?
Alternatives requires more commands to type, rebuild container etc.
- Provide instruction on how to generating new self signed cert
- Disable security https://opensearch.org/docs/latest/security-plugin/configuration/disable/#docker
Do you have any additional context?
N/A
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Java client documentation at https://opensearch.org/docs/latest/clients/java/ and review the supplied RestHighLevelClient example for local Docker connections. Document how to disable certificate and hostname verification for self-signed local certificates, with the existing alternatives and local-testing context, and make the example clear when the documentation is updated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, java
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100