MQTT Modular Input - Fails to connect via SSL/TLS

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

没读研的小蝌蚪 · Solved: How to use ...· 1 月前 ·

活泼的罐头 · java如何设置四种随机颜色 | ...· 1 月前 ·

买醉的手链 · 《不死军团/亡灵军团 Undead ...· 3 月前 ·

贪玩的手套 · 广河高铁机场段12月26日开工· 6 月前 ·

坏坏的西红柿 · 穿成男主白月光by花柒酒免费阅读最新章节,清 ...· 8 月前 ·

一身肌肉的松球 · 有哪些软件可以免费看电影还能投屏到电视上？ ...· 1 年前 ·

I have a Splunk 7.2.1 docker image.
I installed Java 1.8.0_181 in the container
I installed the MQTT Modular input via the GUI

I configured a mosquitto MQTT server (NON-SSL/TLS)
I used the mosquitto_sub / mosquitto_pub cli tools to confirm all is working.
I connected the MQTT Modular input to the mosquitto server and receive messages just fine into splunk.

I reconfigure mosquitto to use a cert signed by a self created CA (ie not verisign etc etc). I have the ca.crt file.
I used the mosquitto_sub / mosquitto_pub cli tools to confirm all is working via TLS/SSL by adding "--cafile ca.crt". Noteably I did NOT change the port from the default port of 1883.

The next steps are guesswork and what I got from googling. Unfortunately there is not really any documentation for using TLS/SSL with this modular input. Right by the "UseSSL" tickbox it just says "Use the "Additional JVM System Properties" parameter to configure key and trust stores." but does not give any further clues as to what settings to actually use.

I copied the ca.crt file to the docker container and ran:
sudo keytool -importcert -keystore /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts -file ca.crt

I ticked the "Use SSL" checkbox for the MQTT Modular input and got connection failures logged.
I added the following in the Additional JVM System Properties:
javax.net.ssl.trustStore=/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts,javax.net.ssl.trustStorePassword=changeit

That still had connection errors so I tried
Djavax.net.ssl.trustStore=/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts,Djavax.net.ssl.trustStorePassword=changeit
That also failed.

I am really unfamiliar with Java so any help would be appreciated

12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  ... 3 more
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at org.eclipse.paho.client.mqttv3.internal.TCPNetworkModule.start(TCPNetworkModule.java:66)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:673)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.Socket.connect(Socket.java:589)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.net.PlainSocketImpl.socketConnect(Native Method)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" Caused by: java.net.ConnectException: Connection refused (Connection refused)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at java.lang.Thread.run(Thread.java:748)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:538)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:77)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py"  at org.eclipse.paho.client.mqttv3.internal.TCPNetworkModule.start(TCPNetworkModule.java:75)
12-11-2018 16:07:47.771 +0000 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/mqtt_ta/bin/mqtt.py" Stanza mqtt://mqtt_test : Error connecting : Unable to connect to server (32103) - java.net.ConnectException: Connection refused (Connection refused)
						Splunk, Splunk>, Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or
						registered trademarks of Splunk Inc. in the United States and other countries. All other brand
						names, product names, or trademarks belong to their respective owners.