[Q/A][Java SDK (Component)] After configuring SSL for the Nacos server, the Dubbo service failed to start.

[doufum]

Pre-check

• I am sure that all the content I provide is in English.

Apache Dubbo Component

Java SDK (apache/dubbo)

Details

Our aim is to add TLS/SSL certificate configuration to all the ports opened by Nacos.
Then, SSL configuration was carried out for the Nacos server:

1. The TLS configuration of the rpc port was enabled. The Dubbo service could be registered successfully. The SSL certificates for ports 9848 and 9849 were configured successfully.

nacos.remote.server.rpc.tls.enableTls=true
nacos.remote.server.rpc.tls.certChainFile=file:/certs/ca/test-server-cert.pem
nacos.remote.server.rpc.tls.certPrivateKey=file:/certs/ca/test-server-key.pem

2. After enabling the SSL configuration of the main port 8848 of Nacos, the Dubbo service began to report errors.

server.ssl.key-alias=nacos_server
server.ssl.key-store=file:/certs/nacos/nacos_server.jks
server.ssl.key-store-type=JKS
server.ssl.key-store-password=123456

Error message:

caused by:
java. lang. RuntimeException: publish nacos metadata failed
at org.apache.dubbo.metadata.store.nacos.NacosMetadataReport.storeMetadata (NacosMetadataReport. java:194)

The DubboConfig configuration is as follows:

@Bean
@Primary
public MetadataReportConfig metadataReportConfig() {
    MetadataReportConfig metadataReportConfig = new MetadataReportConfig();
    String nacosAddr = env.getProperty(NACOS_ADDR);
    String nacosUsername = env.getProperty(NACOS_USERNAME);
    String nacosPassword = decodeCipher(env.getProperty(NACOS_CIPHER));
    String addr = "nacos://" + nacosAddr;
    metadataReportConfig.setAddress(addr);
    metadataReportConfig.setUsername(nacosUsername);
    metadataReportConfig.setPassword(nacosPassword);
    return metadataReportConfig;
}

@Bean
@Primary
public RegistryConfig registryConfig() {
    RegistryConfig registryConfig = new RegistryConfig();
    String nacosAddr = env.getProperty(NACOS_ADDR);
    String nacosUsername = env.getProperty(NACOS_USERNAME);
    String nacosPassword = decodeCipher(env.getProperty(NACOS_CIPHER));
    String cacheFile = env.getProperty(NACOS_CACHE_FILE);
    String addr = "nacos://" + nacosAddr + "?username=" + nacosUsername + "&password=" + nacosPassword;
    registryConfig.setAddress(addr);
    registryConfig.setFile(cacheFile);
    registryConfig.setCheck(false);
    registryConfig.setSimplified(true);
    registryConfig.setExtraKeys("ssl-enabled");
    registryConfig.setUsername(nacosUsername);
    registryConfig.setPassword(nacosPassword);

    return registryConfig;
}

@Bean
public SslConfig sslConfig() {
    SslConfig sslConfig = new SslConfig();
    // 是否开启ssl，false为不开启
    if (!BooleanUtil.toBoolean(env.getProperty(SSL_ENABLE))) {
        return sslConfig;
    }

    // 信任证书
    String collectionCert = env.getProperty(SSL_CERT_COLLECTION);
    // 证书
    String cert = env.getProperty(SSL_CERT);
    // 私钥
    String priKey = env.getProperty(SSL_KEY);
    // 私钥密码
    String password = env.getProperty(SSL_CERT_CIPHER);
    if(!StrUtil.isEmpty(password)){
        if(isEncrypted(password)){
            password=decrypt(password);
        }
    }

    // server
    // 服务端信任证书
    sslConfig.setServerTrustCertCollectionPath(collectionCert);
    // 服务端证书
    sslConfig.setServerKeyCertChainPath(cert);
    // 服务端私钥
    sslConfig.setServerPrivateKeyPath(priKey);

    // consumer
    // 客户端信任证书
    sslConfig.setClientTrustCertCollectionPath(collectionCert);
    // 客户端证书
    sslConfig.setClientKeyCertChainPath(cert);
    // 客户端私钥
    sslConfig.setClientPrivateKeyPath(priKey);

    if (StrUtil.isNotEmpty(password)) {
        // 服务端私钥密码
        sslConfig.setServerKeyPassword(password);
        // 客户端私钥密码
        sslConfig.setClientKeyPassword(password);
    }

    // 支持协议TLSv1.2
    sslConfig.setProtocols(PROTOCOLS);

    // 支持密码格式
    sslConfig.setCiphers(CIPHERS);

    return sslConfig;
}

I took a look at the logs in Nacos, and the erroneous logs are as follows:
remote-digest.log

2024-06-22 17:07:49,351 WARN [1719047268876_10.36.3.39_51270] connection  close exception  : {}

java.lang.IllegalStateException: call already closed
	at com.google.common.base.Preconditions.checkState(Preconditions.java:508)
	at io.grpc.internal.ServerCallImpl.closeInternal(ServerCallImpl.java:219)
	at io.grpc.internal.ServerCallImpl.close(ServerCallImpl.java:212)
	at io.grpc.stub.ServerCalls$ServerCallStreamObserverImpl.onCompleted(ServerCalls.java:395)
	at com.alibaba.nacos.core.remote.grpc.GrpcConnection.closeBiStream(GrpcConnection.java:143)
	at com.alibaba.nacos.core.remote.grpc.GrpcConnection.close(GrpcConnection.java:131)
	at com.alibaba.nacos.core.remote.ConnectionManager.unregister(ConnectionManager.java:159)
	at com.alibaba.nacos.core.remote.grpc.AddressTransportFilter.transportTerminated(AddressTransportFilter.java:77)
	at io.grpc.internal.ServerImpl$ServerTransportListenerImpl.transportTerminated(ServerImpl.java:455)
	at io.grpc.netty.shaded.io.grpc.netty.NettyServerTransport.notifyTerminated(NettyServerTransport.java:207)
	at io.grpc.netty.shaded.io.grpc.netty.NettyServerTransport.access$100(NettyServerTransport.java:51)
	at io.grpc.netty.shaded.io.grpc.netty.NettyServerTransport$1TerminationNotifier.operationComplete(NettyServerTransport.java:141)
	at io.grpc.netty.shaded.io.grpc.netty.NettyServerTransport$1TerminationNotifier.operationComplete(NettyServerTransport.java:134)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:578)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:571)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:550)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:491)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.setValue0(DefaultPromise.java:616)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.setSuccess0(DefaultPromise.java:605)
	at io.grpc.netty.shaded.io.netty.util.concurrent.DefaultPromise.trySuccess(DefaultPromise.java:104)
	at io.grpc.netty.shaded.io.netty.channel.DefaultChannelPromise.trySuccess(DefaultChannelPromise.java:84)
	at io.grpc.netty.shaded.io.netty.channel.AbstractChannel$CloseFuture.setClosed(AbstractChannel.java:1164)
	at io.grpc.netty.shaded.io.netty.channel.AbstractChannel$AbstractUnsafe.doClose0(AbstractChannel.java:755)
	at io.grpc.netty.shaded.io.netty.channel.AbstractChannel$AbstractUnsafe.close(AbstractChannel.java:731)
	at io.grpc.netty.shaded.io.netty.channel.AbstractChannel$AbstractUnsafe.close(AbstractChannel.java:620)
	at io.grpc.netty.shaded.io.netty.channel.epoll.AbstractEpollChannel$AbstractEpollUnsafe.shutdownInput(AbstractEpollChannel.java:522)
	at io.grpc.netty.shaded.io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:823)
	at io.grpc.netty.shaded.io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:487)
	at io.grpc.netty.shaded.io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:385)
	at io.grpc.netty.shaded.io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997)
	at io.grpc.netty.shaded.io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
	at io.grpc.netty.shaded.io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.lang.Thread.run(Thread.java:750)
2024-06-22 17:07:49,351 INFO [1719047268876_10.36.3.39_51270]client disconnected,clear config listen context

2024-06-22 17:07:49,915 INFO Connection transportTerminated,connectionId = 1719047238233_10.36.3.39_51268

2024-06-22 17:07:49,915 INFO [1719047238233_10.36.3.39_51268]client disconnected,clear config listen context

2024-06-22 17:07:49,915 INFO Connection transportTerminated,connectionId = 1719047237565_10.36.3.39_51266

How can I start the Dubbo service normally and complete the service registration after enabling the SSL certificate on port 8848 of Nacos?

Code of Conduct

• I agree to follow this project's Code of Conduct

[AlbumenJ]

This should be the issue of Nacos