trini版本470
一、官方文檔
doc
在Security/TLS and HTTPS、Security/PEM files和Security/JKS files下
openssl文檔
二、配置trino
2.1 創建server.cnf文件
[ req ]
distinguished_name = req_distinguished_name
req_extensions = v3_req[ req_distinguished_name ]
countryName = CN
countryName_default = CN
stateOrProvinceName = BEIJING
stateOrProvinceName_default = BEIJING
localityName = CHAOYANG
localityName_default = CHAOYANG
0.organizationName = BAIDU
0.organizationName_default = BAIDU
organizationalUnitName = IT
organizationalUnitName_default = IT
commonName = trino
commonName_max = 64[ v3_req ]
basicConstraints = CA:FALSE
subjectAltName = @alt_names[ alt_names ]
IP.1 = 192.168.100.101
DNS.1 = trino-01.baidu.com2.2 重點
trino不支持pem文件，雖然文檔里注明支持，但實際測試etc目錄配置pem，trino無法識別啟動后也不會報錯，但keytool/jdbc等客戶端無法獲取正確的證書，獲取到的是trino自動生成的證書，報錯內容：unable to find valid certification path to requested target，可以通過idea連接jdbc開啟-Djavax.net.debug=all獲取到
這里我們check subjectAltName即可，其內容應該與server.cnf中配置的alt_names項目一致。此處可以看到完全不一致，另外"subject" : "CN=dev2"也像是自動生成的，subject內容應該就是openssl req -new ... -subj后的內容。
具體報錯日志如下
javax.net.ssl|DEBUG|10|main|2025-04-03 18:36:16.771 CST|CertificateMessage.java:1143|Consuming server Certificate handshake message (
"Certificate": {"certificate_request_context": "","certificate_list": [ {"certificate" : {"version" : "v3","serial number" : "0195EFD62826","signature algorithm": "SHA256withRSA","issuer" : "CN=dev2","not before" : "2025-04-01 08:00:00.000 CST","not after" : "2035-04-02 07:59:59.000 CST","subject" : "CN=dev2","subject public key" : "RSA","extensions" : [{ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: 49 CB 36 D3 DD 04 A9 EA 30 FD 47 86 79 51 F5 46 I.6.....0.G.yQ.F0010: BD B8 03 CB ....]]},{ObjectId: 2.5.29.19 Criticality=trueBasicConstraints:[CA:truePathLen: no limit]},{ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [DNSName: 192-168-122-1.ipDNSName: 192-168-100-101.ipDNSName: x--1.ipDNSName: 127-0-0-1.ipIPAddress: 192.168.122.1IPAddress: 192.168.100.101IPAddress: 0:0:0:0:0:0:0:1IPAddress: 127.0.0.1]},{ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 49 CB 36 D3 DD 04 A9 EA 30 FD 47 86 79 51 F5 46 I.6.....0.G.yQ.F0010: BD B8 03 CB ....]]}]}"extensions": {<no extension>}},
]
}
)
2.3 具體配置
# 1. 生成自簽名根證書
openssl genrsa -out ca.key -passout pass:trino-ts -des3 2048
# -x509: This option outputs a self signed certificate instead of a certificate request
openssl req -x509 -key ca.key -out ca.crt -subj "/C=CN/ST=BEIJING/L=CHAOYANG/O=BAIDU/OU=IT/CN=CA"
openssl x509 -in ca.crt -text -noout# 2. 生成trino-server keystore內容
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr -subj "/C=CN/ST=BEIJING/L=CHAOYANG/O=BAIDU/OU=IT/CN=trino-01.baidu.com"
openssl x509 -req -days 365 -in server.csr -out server.crt -extfile server.cnf -extensions v3_req -CA ca.crt -CAkey ca.key -CAcreateserial
# 驗證所有信息
openssl x509 -in server.crt -text -noout
# 很多信息，當然也包含subjectAltName
# 只驗證subjectAltName
openssl x509 -in server.crt -ext subjectAltName -noout
# X509v3 Subject Alternative Name:
# IP Address:192.168.100.101, DNS:trino-01.baidu.com
# 驗證簽名是否ok
openssl verify -CAfile ca.crt server.crt
# server.crt: OK
openssl pkcs12 -export -out server.p12 -inkey server.key -in server.crt
# 輸入：trino-01
openssl x509 -in server.crt -text -noout
openssl pkcs12 -info -in server.p12 # 需要多次輸入：trino-01# 替換原有配置
rm -rf /$TRINO_HOME/etc/server.p12 && cp server.p12 /$TRINO_HOME/etc/# 3. 本地jdk注入自簽名ca
# 刪除
keytool -delete -storepass changeit -alias trino-ts -keystore /$JAVA_HOME/security/cacerts
# 注入
keytool -import -v -trustcacerts -alias trino-ts -file ca.crt -storepass changeit -keystore /$JAVA_HOME/security/cacerts
# 驗證注入結果
keytool -list -storepass changeit -alias trino-ts -keystore /$JAVA_HOME/security/cacerts# 4. 修改config.properties，見下文
# 5. 重啟trino server
$TRINO_HOME/bin/launcher restart# 6. 訪問web頁面
https://trino-01.baidu.com/ui/login.html# 7. 驗證trino-server是否使用生產的證書（crt文件）。
# 使用其他服務器或者win獲取trino的https證書即crt文件內容。
keytool -printcert -rfc -sslserver trino-01.baidu.com:443 > server-remote.crt
cat server-remote.crt # win命令是：type server-remote.crt
# 注意：此處得到的內容應和server.crt完全一致！！！
openssl x509 -in server-remote.crt -text -ext subjectAltName -noout
openssl verify -CAfile ca.crt server-remote.crt # server-remote.crt： OK
修改$TRINO_HOME/etc/config.properties文件
http-server.https.enabled=true
http-server.https.port=443
http-server.https.keystore.path=etc/server.p12
http-server.https.keystore.key=trino-01
2.4 win端配置jdk(可選dbeaver會用到)
修改win的jdk注入，自簽名ca。
# win jdk
keytool -delete -storepass changeit -alias trino-ts -keystore %JAVA_HOME%\lib\security\cacerts
keytool -import -v -trustcacerts -alias trino-ts -file ca.crt -storepass changeit -keystore %JAVA_HOME%\lib\security\cacerts
三、jdbc驗證
java/kotlin jdbc驗證，此處使用kotlin語言：
TLS/SSL的debug日志需要在VM options處添加-Djavax.net.debug=all
通過tls/ssl需要使用如下方法（1）-（4）中的任意一種。
使用gradle構建項目，build.gradle內容：
plugins { id 'org.jetbrains.kotlin.jvm' version '1.9.23'
} group = 'com.ls'
version = '1.0-SNAPSHOT' repositories { maven { url "https://maven.aliyun.com/repository/public" } maven { url "https://maven.aliyun.com/repository/gradle-plugin" } maven { url "https://maven.aliyun.com/repository/central" } maven { url "https://maven.aliyun.com/repository/jcenter" } maven { url "https://maven.aliyun.com/repository/google" } maven { url "https://maven.aliyun.com/repository" } google() mavenCentral() maven { url 'https://jitpack.io' }
} dependencies { testImplementation 'org.jetbrains.kotlin:kotlin-test' testImplementation("io.trino:trino-jdbc:470")
} test { useJUnitPlatform()
}
kotlin { jvmToolchain(21)
}
import org.junit.jupiter.api.Test
import java.sql.DriverManager
import java.util.Properties class TrinoJdbcTest { @Test fun fistHead() { println("hello") } @Test fun tsHost() { val user = "myuser" val password = "your_password" val url = "jdbc:trino://trino-01.baidu.com:443/hive" runShowCatalog(url,user, password) } @Test fun tsIp() { val user = "myuser" val password = "your_password" val url = "jdbc:trino://192.168.100.101:443/hive" runShowCatalog(url,user, password) } fun runShowCatalog(url:String,user: String, password: String) { val props = Properties() props.put("user", user) props.put("password", password) props.put("SSL", "true") // (1) no Verification
// props.put("SSLVerification","NONE") // must set SSL as true! // (2) from Self Verificated CA props.put("SSLTrustStorePath", "D:\\certs\\ca.crt") // (3) from jvm CA,which is injected with Self Verificated CA // keytool -import -v -trustcacerts -alias trino-ts -file D:\certs\ca.crt -storepass changeit -keystore %JAVA_HOME%\lib\security\cacerts // must provide the password for jvm and it defualt is "changeit"// props.put("SSLTrustStorePath","%JAVA_HOME%\\lib\\security\\cacerts") // props.put("SSLTrustStorePassword","changeit") // 可選：optional client key store，client秘鑰和證書的生成方式和sever的全稱一致。 // openssl pkcs12 -export -out workspace-client.p12 -inkey workspace-client.key -in workspace-client.crt -passout pass:trino-client // props.put("SSLKeyStorePath","D:\\projects\\trino-jdbc-test\\src\\test\\resources\\workspace-client.pem") // failed // props.put("SSLKeyStorePath","D:\\certs\\client.pem") 、// props.put("SSLKeyStorePassword","trino-client") // maybe use SSLUseSystemKeyStore // props.put("SSLUseSystemTrustStore","true") Class.forName("io.trino.jdbc.TrinoDriver") val conn = DriverManager.getConnection(url, props) val stmt = conn.createStatement() val query = stmt.executeQuery("show catalogs") while (query.next()) { val db = query.getString(1) println(db) } } }
)
