知识库

解决 TLS 证书错误

TLS 加密在任何地方都是必需的。这是您在配置服务器时可能遇到的几个错误的汇编。openssl 命令用于诊断或操作证书。

检查文件夹的权限

neo4j 可能会作为具有非特权用户的 systemd 服务运行。在您的配置中指定的文件夹“$NEO4J_HOME/certificates/<POLICY_NAME>”必须可由 neo4j 用户写入。

检查私钥

私钥必须以 3.5.x 中的 PKCS8 格式、PEM 格式且没有任何密码短语。PKCS12 将在将来的版本中得到支持。以下命令应在不提示任何密码的情况下返回证书。

$ openssl rsa -in private.key -check

您可以使用以下命令删除密码短语：

$ openssl rsa -in private.key -out private_key_without_passphrase.key

文件夹“certificates/<POLICY_NAME>/trusted”只能包含 DER 格式的有效证书

如果您遇到signed overrun错误。您可能需要查看 trusted/revoked 文件夹中包含的每个文件，包括隐藏文件。

2019-10-24 15:17:36.595+0200 ERROR Failed to start Neo4j: Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6f36c2f0' was successfully initialized, but failed to start. Please see the attached cause exception "signed overrun, bytes = 918". Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6f36c2f0' was successfully initialized, but failed to start. Please see the attached cause exception "signed overrun, bytes = 918".
org.neo4j.server.ServerStartupException: Starting Neo4j failed: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6f36c2f0' was successfully initialized, but failed to start. Please see the attached cause exception "signed overrun, bytes = 918".
at org.neo4j.server.exception.ServerStartupErrors.translateToServerStartupError(ServerStartupErrors.java:45)
at org.neo4j.server.AbstractNeoServer.start(AbstractNeoServer.java:187)
at org.neo4j.server.ServerBootstrapper.start(ServerBootstrapper.java:124)
at org.neo4j.server.ServerBootstrapper.start(ServerBootstrapper.java:91)
at com.neo4j.server.enterprise.CommercialEntryPoint.main(CommercialEntryPoint.java:22)
Caused by: org.neo4j.kernel.lifecycle.LifecycleException: Component 'org.neo4j.server.database.LifecycleManagingDatabase@6f36c2f0' was successfully initialized, but failed to start. Please see the attached cause exception "signed overrun, bytes = 918".
at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.start(LifeSupport.java:473)
at org.neo4j.kernel.lifecycle.LifeSupport.start(LifeSupport.java:111)
at org.neo4j.server.AbstractNeoServer.start(AbstractNeoServer.java:180)
... 3 more
Caused by: java.lang.RuntimeException: Failed to create trust manager based on: /neo4j/certificates/xxx/trusted
at org.neo4j.kernel.configuration.ssl.SslPolicyLoader.load(SslPolicyLoader.java:222)
at org.neo4j.kernel.configuration.ssl.SslPolicyLoader.create(SslPolicyLoader.java:99)
at org.neo4j.graphdb.factory.module.edition.CommunityEditionModule.<init>(CommunityEditionModule.java:98)
at org.neo4j.kernel.impl.enterprise.EnterpriseEditionModule.<init>(EnterpriseEditionModule.java:55)
at com.neo4j.commercial.edition.CommercialEditionModule.<init>(CommercialEditionModule.java:48)
at org.neo4j.graphdb.facade.GraphDatabaseFacadeFactory.initFacade(GraphDatabaseFacadeFactory.java:181)
at com.neo4j.commercial.edition.CommercialGraphDatabase.<init>(CommercialGraphDatabase.java:20)
at com.neo4j.server.database.CommercialGraphFactory.newGraphDatabase(CommercialGraphFactory.java:40)
at org.neo4j.server.database.LifecycleManagingDatabase.start(LifecycleManagingDatabase.java:90)
at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.start(LifeSupport.java:452)
... 5 more
Caused by: java.security.cert.CertificateException: Error loading certificate file: /neo4j/certificates/xxx/private.key
at org.neo4j.kernel.configuration.ssl.SslPolicyLoader.createTrustManagerFactory(SslPolicyLoader.java:363)
at org.neo4j.kernel.configuration.ssl.SslPolicyLoader.load(SslPolicyLoader.java:218)
... 14 more
Caused by: java.security.cert.CertificateParsingException: signed overrun, bytes = 918
at sun.security.x509.X509CertImpl.parse(X509CertImpl.java:1788)
at sun.security.x509.X509CertImpl.<init>(X509CertImpl.java:195)
at sun.security.provider.X509Factory.engineGenerateCertificate(X509Factory.java:102)
at java.security.cert.CertificateFactory.generateCertificate(CertificateFactory.java:339)
at org.neo4j.kernel.configuration.ssl.SslPolicyLoader.createTrustManagerFactory(SslPolicyLoader.java:358)
... 15 more
2019-10-24 15:17:36.597+0200 INFO Neo4j Server shutdown initiated by request

自签名证书

您可以使用以下命令生成密钥和公钥证书。

$ openssl req -x509 -newkey rsa:2048 -keyout private_key.pem -out public_cert.pem -days 30

您需要在 neo4j.conf 中设置`dbms.ssl.policy.<policyname>.trust_all=true`。请注意，这是不安全的。

CA 签名的证书

所有证书都应以 DER 编码格式存储在受信任目录中。证书链必须完整才能允许通信。