目录一、环境信息二、介绍三、实验步骤1、备份openssl.cnf2、修改openssl.cnf3、基目录创建4、服务端和客户端证书存放目录创建5、用户客户端证书存放目录创建6、目录树展示7、CA证书生成8、服务器私钥生成9、签发申请生成10、CA签名证书生成11、证书格式转换为x509格式12、拷贝文件13、客户端用户私钥生成14、客户端用户证书签发申请15、客户端用户CA根证书16、转换为pkcs12格式17、JDBC .keystore文件生成1导入CA根证书2导入服务器证书3导入客户端私钥和证书18、自签名CA根证书拷贝19、部署服务端证书20、客户端证书修改用户组21、数据库参数修改22、不加证书disql登录失败23、加证书disql登录成功24、JDBC连接1jdbc_conn.java源码2编译3运行一、环境信息名称值CPUIntel(R) Core(TM) i5-1035G1 CPU 1.00GHz操作系统CentOS Linux release 7.9.2009 (Core)内存5G逻辑核数6DM版本1 DM Database Server 64 V82 DB Version: 0x7000c3 03134284194-20240703-234060-201084 Msg Version: 125 Gsu level(5) cnt: 0二、介绍基于传输层的 SSL 协议加密选择是否使用 SSL 协议加密以 DM 数据库服务器端的设置为准即通过设置服务器配置文件 DM.INI 中的 ENABLE_ENCRYPT 参数来指定客户端以服务器采用的通信方式与其。进行通信。三、实验步骤1、备份openssl.cnf[rootlocalhost ~]# cp /etc/pki/tls/openssl.cnf /etc/pki/tls/openssl.cnf_bak2、修改openssl.cnf[ CA_default ] dir /opt/ca # Where everything is kept certs $dir/certs # Where the issued certs are kept crl_dir $dir/crl # Where the issued crl are kept database $dir/index.txt # database index file. #unique_subject no # Set to no to allow creation of # several ctificates with same subject. new_certs_dir $dir/newcerts # default place for new certs. certificate $dir/ca-cert.pem # The CA certificate serial $dir/serial # The current serial number crlnumber $dir/crlnumber # the current crl number # must be commented out to leave a V1 CRL crl $dir/crl.pem # The current CRL private_key $dir/ca-key.pem # The private key RANDFILE $dir/.rand # private random number file x509_extensions usr_cert # The extentions to add to the cert只修改[ CA_default ]标签下的参数dir、certificate、private_key、RANDFILE其他不动。3、基目录创建mkdir -p /opt/ca cd /opt/ca mkdir {certs,crl,newcerts} echo 01 serial touch index.txt4、服务端和客户端证书存放目录创建mkdir /opt/ca/server_ssl mkdir /opt/ca/client_ssl5、用户客户端证书存放目录创建数据库中所有用户都需要生成客户端证书否则无法登录。这里以SYSDBA为例其他用户需创建相应名字的目录。mkdir -p /opt/ca/client_ssl/SYSDBA6、目录树展示[rootlocalhost ca]# tree . ├── certs ├── client_ssl │ └── SYSDBA ├── crl ├── index.txt ├── newcerts ├── serial └── server_ssl7、CA证书生成密码设置简单一些我这边是123456[rootlocalhost ca]# openssl req -new -x509 -days 3650 -keyout ca-key.pem -out ca-cert.pem -subj /Ccn/STguangdong/Lguangzhou/Odameng/OUdev/CNlw/emailAddressabcdm.com Generating a 2048 bit RSA private key .................................. .......... writing new private key to ca-key.pem Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----- [rootlocalhost ca]# ll 总用量 12 -rw-r--r--. 1 root root 1375 8月 6 20:47 ca-cert.pem -rw-r--r--. 1 root root 1834 8月 6 20:47 ca-key.pem drwxr-xr-x. 2 root root 6 8月 6 20:36 certs drwxr-xr-x. 3 root root 20 8月 6 20:37 client_ssl drwxr-xr-x. 2 root root 6 8月 6 20:36 crl -rw-r--r--. 1 root root 0 8月 6 20:36 index.txt drwxr-xr-x. 2 root root 6 8月 6 20:36 newcerts -rw-r--r--. 1 root root 3 8月 6 20:36 serial drwxr-xr-x. 2 root root 6 8月 6 20:37 server_ssl [rootlocalhost ca]#可以看到生成了CA私钥和根证书。8、服务器私钥生成[rootlocalhost ca]# openssl genrsa -out server_ssl/server-key.pem Generating RSA private key, 2048 bit long modulus ....................................................... ............ e is 65537 (0x10001)9、签发申请生成[rootlocalhost ca]# openssl req -new -key server_ssl/server-key.pem -out server_ssl/server.csr -subj /Ccn/STguangdong/Lguangzhou/Odameng/OUdev/CNserver/emailAddressserverdm.com10、CA签名证书生成密码还是123456[rootlocalhost ca]# openssl ca -days 3650 -in server_ssl/server.csr -out server_ssl/server-cert.pem Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /opt/ca/ca-key.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Aug 6 12:56:29 2026 GMT Not After : Aug 3 12:56:29 2036 GMT Subject: countryName cn stateOrProvinceName guangdong organizationName dameng organizationalUnitName dev commonName server emailAddress serverdm.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: CC:2A:96:FF:04:0A:8A:32:03:EB:9D:53:DB:8C:1B:54:C6:A4:F0:58 X509v3 Authority Key Identifier: keyid:ED:9E:B5:5F:B9:33:D1:34:38:17:21:E0:9B:6E:EC:93:5D:C9:F4:FE Certificate is to be certified until Aug 3 12:56:29 2036 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated11、证书格式转换为x509格式[rootlocalhost ca]# openssl x509 -in server_ssl/server-cert.pem -out server_ssl/server.cer12、拷贝文件[rootlocalhost ca]# cp ca-cert.pem server_ssl [rootlocalhost ca]# cp ca-key.pem server_ssl13、客户端用户私钥生成密码还是123456[rootlocalhost ca]# openssl genrsa -aes256 -out client_ssl/SYSDBA/client-key.pem Generating RSA private key, 2048 bit long modulus ................................................. .................................... e is 65537 (0x10001) Enter pass phrase for client_ssl/SYSDBA/client-key.pem: Verifying - Enter pass phrase for client_ssl/SYSDBA/client-key.pem:14、客户端用户证书签发申请[rootlocalhost ca]# openssl req -new -key client_ssl/SYSDBA/client-key.pem -out client_ssl/SYSDBA/client.csr -subj /Ccn/STguangdong/Lguangzhou/Odameng/OUdev/CNSYSDBA/emailAddressdmclientdm.com Enter pass phrase for client_ssl/SYSDBA/client-key.pem:15、客户端用户CA根证书[rootlocalhost ca]# openssl ca -days 365 -in client_ssl/SYSDBA/client.csr -out client_ssl/SYSDBA/client-cert.pem Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for /opt/ca/ca-key.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: 2 (0x2) Validity Not Before: Aug 6 13:05:59 2026 GMT Not After : Aug 6 13:05:59 2027 GMT Subject: countryName cn stateOrProvinceName guangdong organizationName dameng organizationalUnitName dev commonName SYSDBA emailAddress dmclientdm.com X509v3 extensions: X509v3 Basic Constraints: CA:FALSE Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: 98:80:33:C5:4F:0A:0E:93:60:59:74:0C:26:DD:CA:9F:46:38:23:61 X509v3 Authority Key Identifier: keyid:ED:9E:B5:5F:B9:33:D1:34:38:17:21:E0:9B:6E:EC:93:5D:C9:F4:FE Certificate is to be certified until Aug 6 13:05:59 2027 GMT (365 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated16、转换为pkcs12格式[rootlocalhost ca]# openssl pkcs12 -export -inkey client_ssl/SYSDBA/client-key.pem -in client_ssl/SYSDBA/client-cert.pem -out client_ssl/SYSDBA/client-pkcs.p12 Enter pass phrase for client_ssl/SYSDBA/client-key.pem: Enter Export Password: Verifying - Enter Export Password:17、JDBC .keystore文件生成1导入CA根证书[rootlocalhost ca]# keytool -import -alias ca -trustcacerts -file ca-cert.pem -keystore client_ssl/SYSDBA/.keystore -deststorepass 123456 -noprompt 证书已添加到密钥库中2导入服务器证书[rootlocalhost ca]# keytool -import -alias server -trustcacerts -file server_ssl/server.cer -keystore client_ssl/SYSDBA/.keystore -deststorepass 123456 -noprompt 证书已添加到密钥库中3导入客户端私钥和证书[rootlocalhost ca]# keytool -importkeystore -srckeystore client_ssl/SYSDBA/client-pkcs.p12 -srcstorepass 123456 -srcstoretype PKCS12 -keystore client_ssl/SYSDBA/.keystore -storetype PKCS12 -deststorepass 123456 正在将密钥库 client_ssl/SYSDBA/client-pkcs.p12 导入到 client_ssl/SYSDBA/.keystore... keytool 错误: java.io.IOException: DerInputStream.getLength(): lengthTag109, too big.报错应该是前面配置错了。[rootlocalhost ca]# openssl pkcs12 -info -in client_ssl/SYSDBA/client-pkcs.p12 -nodes无输出则损坏。[rootlocalhost ca]# rm -f client_ssl/SYSDBA/.keystore删除旧的 keystore 文件。[rootlocalhost ca]# keytool -importkeystore -srckeystore client_ssl/SYSDBA/client-pkcs.p12 -srcstoretype PKCS12 -srcstorepass 123456 -destkeystore client_ssl/SYSDBA/.keystore -deststoretype PKCS12 -deststorepass 123456 正在将密钥库 client_ssl/SYSDBA/client-pkcs.p12 导入到 client_ssl/SYSDBA/.keystore... 已成功导入别名 1 的条目。 已完成导入命令: 1 个条目成功导入, 0 个条目失败或取消导入PKCS12文件。[rootlocalhost ca]# keytool -import -alias ca -trustcacerts -file ca-cert.pem -keystore client_ssl/SYSDBA/.keystore -storepass 123456 -noprompt 证书已添加到密钥库中导入CA根证书。[rootlocalhost ca]# keytool -import -alias server -trustcacerts -file server_ssl/server.cer -keystore client_ssl/SYSDBA/.keystore -storepass 123456 -noprompt 证书已添加到密钥库中导入服务器证书。[rootlocalhost ca]# keytool -importkeystore -srckeystore client_ssl/SYSDBA/client-pkcs.p12 -srcstorepass 123456 -srcstoretype PKCS12 -keystore client_ssl/SYSDBA/.keystore -storetype PKCS12 -deststorepass 123456 正在将密钥库 client_ssl/SYSDBA/client-pkcs.p12 导入到 client_ssl/SYSDBA/.keystore... 存在现有条目别名 1, 是否覆盖? [否]: 1 错误的答案, 请再试一次 存在现有条目别名 1, 是否覆盖? [否]: y 已成功导入别名 1 的条目。 已完成导入命令: 1 个条目成功导入, 0 个条目失败或取消这次正常了。18、自签名CA根证书拷贝[rootlocalhost ca]# cp ca-cert.pem client_ssl/SYSDBA/19、部署服务端证书mv /opt/Dm8/bin/server_ssl /opt/Dm8/bin/server_ssl_bak cp -r /opt/ca/server_ssl /opt/Dm8/bin/ chown -R dmdba:dmdba /opt/Dm8/bin/server_ssl20、客户端证书修改用户组[rootlocalhost ca]# chown -R dmdba:dmdba /opt/ca/client_ssl21、数据库参数修改ENABLE_ENCRYPT改为1重启数据库。SP_SET_PARA_VALUE (2,ENABLE_ENCRYPT,1);22、不加证书disql登录失败[dmdbalocalhost ~]$ disql SYSDBA/qwer1234S SSL_do_handshake failure [-70019]:网络通讯失败. disql V8 用户名:23、加证书disql登录成功[dmdbalocalhost ~]$ disql SYSDBA/qwer1234S192.168.217.66:5236#{SSL_PATH/opt/ca/client_ssl/SYSDBA,SSL_PWD123456} 服务器[192.168.217.66:5236]:处于普通打开状态 登录使用时间 : 16.871(ms) disql V8 SQL quit24、JDBC连接1jdbc_conn.java源码import java.sql.Connection; import java.sql.DriverManager; import java.sql.SQLException; public class jdbc_conn { static String cname dm.jdbc.driver.DmDriver; static String url jdbc:dm://writemaster?writemaster(192.168.217.66:5236)schemaSYSDBAsocketTimeout0connectTimeout25000sslFilesPath/opt/ca/client_ssl/SYSDBAsslKeystorePass123456; static String userid SYSDBA; static String pwd qwer1234S; public static void main(String[] args) { for (int i 1; i 5; i) { Connection con null; // 每次循环独立 try { Class.forName(cname); con DriverManager.getConnection(url, userid, pwd); con.setAutoCommit(true); System.out.println([SUCCESS] conn database - 第 i 次); } catch (Exception e) { System.out.println([FAIL] conn database - 第 i 次 e.getMessage()); } finally { try { disConn(con); } catch (SQLException e) { System.out.println([WARN] 关闭连接失败 - 第 i 次 e.getMessage()); } } } } public static void disConn(Connection con) throws SQLException { if (con ! null) { con.close(); } } }2编译javac -cp .:/opt/Dm8/drivers/jdbc/DmJdbcDriver8.jar jdbc_conn.java3运行[dmdbalocalhost JDBC]$ java -cp .:/opt/Dm8/drivers/jdbc/DmJdbcDriver8.jar jdbc_conn [SUCCESS] conn database - 第1次 [SUCCESS] conn database - 第2次 [SUCCESS] conn database - 第3次 [SUCCESS] conn database - 第4次 [SUCCESS] conn database - 第5次