在我之前的教程 “Elasticsearch：使用最新的 Elasticsearch Java client 8.0 来创建索引并搜索”，我详述了如何使用 Java client 8.0 来连接一个 Elasticsearch 8.x 的集群。在那个例子中，我们的 Elasticsearch 集群是不带有 HTTPS 的安全设置的。在 Elasticsearch 8.x 的安装中，HTTPS 的配置是默认的，而且它的证书是自签名的。我们该如何修改我们的 Java 客户端代码来进行含有证书的连接呢？

如果你还没有安装好自己的 Elasticsearch 集群，你可以参考我之前的文章 “如何在 Linux，MacOS 及 Windows 上进行安装 Elasticsearch” 来进行安装。

在接下来的示例中，我将使用 Elasticsearch 8.1.1 来进行展示。为了大家更好地理解我下面的代码，我把代码放到 github 上。你可以通过如下的命令来进行下载：

git clone https://github.com/liu-xiao-guo/elasticsearchjava-search8-https

在这篇文章中，我着重来讲一下和 Elasticsearch 的连接部分。其它的展示和之前的文章  “Elasticsearch：使用最新的 Elasticsearch Java client 8.0 来创建索引并搜索” 类似。

使用 Elasticsearch Java client 8.0 来连接带有 HTTPS 的集群_哔哩哔哩_bilibili

使用用户名及密码来进行连接

我们可以使用自己账号的用户名及密码来进行连接。在我们的展示中，我使用超级用户 elastic 来进行展示：

   private static synchronized void makeConnection_https() throws CertificateException, IOException, 
    		NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
        final CredentialsProvider credentialsProvider =
                new BasicCredentialsProvider();
        credentialsProvider.setCredentials(AuthScope.ANY,
                new UsernamePasswordCredentials("elastic", "FW5S2hBXhCNZDZ7BX9O-"));

        Path caCertificatePath = Paths.get("/Users/liuxg/test/elasticsearch-8.1.2/config/certs/http_ca.crt");
        CertificateFactory factory =
                CertificateFactory.getInstance("X.509");
        Certificate trustedCa;
        try (InputStream is = Files.newInputStream(caCertificatePath)) {
            trustedCa = factory.generateCertificate(is);
        }
        KeyStore trustStore = KeyStore.getInstance("pkcs12");
        trustStore.load(null, null);
        trustStore.setCertificateEntry("ca", trustedCa);
        SSLContextBuilder sslContextBuilder = SSLContexts.custom()
                .loadTrustMaterial(trustStore, null);
        final SSLContext sslContext = sslContextBuilder.build();

        RestClientBuilder builder = RestClient.builder(
                        new HttpHost("localhost", 9200, "https"))
                .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                    @Override
                    public HttpAsyncClientBuilder customizeHttpClient(
                            HttpAsyncClientBuilder httpClientBuilder) {
                        return httpClientBuilder.setSSLContext(sslContext)
                                .setDefaultCredentialsProvider(credentialsProvider);
                    }
                });

        RestClient restClient = builder.build();

        // Create the transport with a Jackson mapper
        ElasticsearchTransport transport = new RestClientTransport(
                restClient, new JacksonJsonpMapper());

        client = new ElasticsearchClient(transport);
        asyncClient = new ElasticsearchAsyncClient(transport);
    }

如上所示，我们需要修改账号 elastic 的密码以及证书的路径。一旦 client 及 asyncClient 被创建，那么我们就可以使用它们来进行操作。

使用 API key 来进行访问

我们创建如下的 makeConnection_token() 方法来进行连接：

    private static synchronized void makeConnection_token() throws CertificateException, IOException, 
    	NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
        Path caCertificatePath = Paths.get("/Users/liuxg/test/elasticsearch-8.1.2/config/certs/http_ca.crt");
        CertificateFactory factory =
                CertificateFactory.getInstance("X.509");
        Certificate trustedCa;
        try (InputStream is = Files.newInputStream(caCertificatePath)) {
            trustedCa = factory.generateCertificate(is);
        }
        KeyStore trustStore = KeyStore.getInstance("pkcs12");
        trustStore.load(null, null);
        trustStore.setCertificateEntry("ca", trustedCa);
        SSLContextBuilder sslContextBuilder = SSLContexts.custom()
                .loadTrustMaterial(trustStore, null);
        final SSLContext sslContext = sslContextBuilder.build();

        RestClientBuilder builder = RestClient.builder(
                        new HttpHost("localhost", 9200, "https"))
                .setHttpClientConfigCallback(new RestClientBuilder.HttpClientConfigCallback() {
                    @Override
                    public HttpAsyncClientBuilder customizeHttpClient(
                            HttpAsyncClientBuilder httpClientBuilder) {
                        return httpClientBuilder.setSSLContext(sslContext);
                    }
                });

//        String apiKeyId = "SY6uOoABwRrDJxOdlx78";
//        String apiKeySecret = "E8Ae8-FgScqT-nXCSBN0ew";
//        String apiKeyAuth =
//                Base64.getEncoder().encodeToString(
//                        (apiKeyId + ":" + apiKeySecret)
//                                .getBytes(StandardCharsets.UTF_8));
//        Header[] defaultHeaders =
//                new Header[]{new BasicHeader("Authorization",
//                        "ApiKey " + apiKeyAuth)};
//        builder.setDefaultHeaders(defaultHeaders);

        Header[] defaultHeaders =
                new Header[]{new BasicHeader("Authorization",
                        "ApiKey U1k2dU9vQUJ3UnJESnhPZGx4Nzg6RThBZTgtRmdTY3FULW5YQ1NCTjBldw==")};
        builder.setDefaultHeaders(defaultHeaders);

        RestClient restClient = builder.build();

        // Create the transport with a Jackson mapper
        ElasticsearchTransport transport = new RestClientTransport(
                restClient, new JacksonJsonpMapper());

        client = new ElasticsearchClient(transport);
        asyncClient = new ElasticsearchAsyncClient(transport);
    }

有关如何创建这个 API key，你可以参阅我之前的文章 “Elasticsearch：创建 API key 接口访问 Elasticsearch”。如果你不想手动来创建，那么你可以使用如下的 Kibana UI 来创建：

其它的操作和之前的文章介绍的是一样的。这里就不再累述了。 

参考：

【1】Other authentication methods | Elasticsearch Java API Client [8.1] | Elastic

【2】Encrypted communication | Elasticsearch Java API Client [8.1] | Elastic