elasticsearch7.4报错failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin elastic-certificates.p12 is blocked的问题解决

elasticsearch7.4报错failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin elastic-certificates.p12 is blocked的问题解决

Java HotSpot(TM) 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
[2020-08-06T17:23:49,014][INFO ][o.e.e.NodeEnvironment    ] [es_node_03] using [1] data paths, mounts [[/ (rootfs)]], net usable_space [163.4gb], net total_space [287.3gb], types [rootfs]
[2020-08-06T17:23:49,018][INFO ][o.e.e.NodeEnvironment    ] [es_node_03] heap size [3.9gb], compressed ordinary object pointers [true]
[2020-08-06T17:23:49,173][INFO ][o.e.n.Node               ] [es_node_03] node name [es_node_03], node ID [mTgqC57BSeCCLYGkt5EAJA], cluster name [es_cluster]
[2020-08-06T17:23:49,174][INFO ][o.e.n.Node               ] [es_node_03] version[7.4.1], pid[79492], build[default/tar/fc0eeb6e2c25915d63d871d344e3d0b45ea0ea1e/2019-10-22T17:16:35.176724Z], OS[Linux/3.10.0-957.27.2.el7.x86_64/amd64], JVM[Oracle Corporation/Java HotSpot(TM) 64-Bit Server VM/12.0.2/12.0.2+10]
[2020-08-06T17:23:49,175][INFO ][o.e.n.Node               ] [es_node_03] JVM home [/usr/local/java/jdk-12.0.2]
[2020-08-06T17:23:49,176][INFO ][o.e.n.Node               ] [es_node_03] JVM arguments [-Xms4g, -Xmx4g, -XX:+UseConcMarkSweepGC, -XX:CMSInitiatingOccupancyFraction=75, -XX:+UseCMSInitiatingOccupancyOnly, -Des.networkaddress.cache.ttl=60, -Des.networkaddress.cache.negative.ttl=10, -XX:+AlwaysPreTouch, -Xss1m, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djna.nosys=true, -XX:-OmitStackTraceInFastThrow, -Dio.netty.noUnsafe=true, -Dio.netty.noKeySetOptimization=true, -Dio.netty.recycler.maxCapacityPerThread=0, -Dio.netty.allocator.numDirectArenas=0, -Dlog4j.shutdownHookEnabled=false, -Dlog4j2.disable.jmx=true, -Djava.io.tmpdir=/tmp/elasticsearch-9063563271402156086, -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath=data, -XX:ErrorFile=logs/hs_err_pid%p.log, -Xlog:gc*,gc+age=trace,safepoint:file=logs/gc.log:utctime,pid,tags:filecount=32,filesize=64m, -Djava.locale.providers=COMPAT, -Dio.netty.allocator.type=pooled, -XX:MaxDirectMemorySize=2147483648, -Des.path.home=/usr/local/tom/elasticsearch-7.4.1, -Des.path.conf=/usr/local/tom/elasticsearch-7.4.1/config, -Des.distribution.flavor=default, -Des.distribution.type=tar, -Des.bundled_jdk=true]
[2020-08-06T17:23:49,898][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [es_node_03] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) ~[elasticsearch-cli-7.4.1.jar:7.4.1]
    at org.elasticsearch.cli.Command.main(Command.java:90) ~[elasticsearch-cli-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:115) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:92) ~[elasticsearch-7.4.1.jar:7.4.1]
Caused by: java.lang.IllegalStateException: failed to load plugin class [org.elasticsearch.xpack.core.XPackPlugin]
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:614) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:311) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:255) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.1.jar:7.4.1]
    ... 6 more
Caused by: java.lang.reflect.InvocationTargetException
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
    at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
    at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:311) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:255) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.1.jar:7.4.1]
    ... 6 more
Caused by: org.elasticsearch.ElasticsearchSecurityException: failed to load SSL configuration [xpack.security.transport.ssl]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:449) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:121) ~[?:?]
    at org.elasticsearch.xpack.core.XPackPlugin.<init>(XPackPlugin.java:142) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
    at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
    at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:311) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:255) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.1.jar:7.4.1]
    ... 6 more
Caused by: org.elasticsearch.ElasticsearchException: failed to initialize SSL TrustManager - access to read truststore file [/usr/local/tom/elasticsearch/config/elastic-certificates.p12] is blocked; SSL resources should be placed in the [/usr/local/tom/elasticsearch-7.4.1/config] directory
    at org.elasticsearch.xpack.core.ssl.TrustConfig.blockedTrustConfigFile(TrustConfig.java:135) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:72) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:384) ~[?:?]
    at java.util.HashMap.computeIfAbsent(HashMap.java:1133) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:446) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:121) ~[?:?]
    at org.elasticsearch.xpack.core.XPackPlugin.<init>(XPackPlugin.java:142) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
    at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
    at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:311) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:255) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.1.jar:7.4.1]
    ... 6 more
Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "/usr/local/tom/elasticsearch/config/elastic-certificates.p12" "read")
    at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472) ~[?:?]
    at java.security.AccessController.checkPermission(AccessController.java:1044) ~[?:?]
    at java.lang.SecurityManager.checkPermission(SecurityManager.java:408) ~[?:?]
    at java.lang.SecurityManager.checkRead(SecurityManager.java:747) ~[?:?]
    at sun.nio.fs.UnixChannelFactory.open(UnixChannelFactory.java:255) ~[?:?]
    at sun.nio.fs.UnixChannelFactory.newFileChannel(UnixChannelFactory.java:143) ~[?:?]
    at sun.nio.fs.UnixChannelFactory.newFileChannel(UnixChannelFactory.java:156) ~[?:?]
    at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:217) ~[?:?]
    at java.nio.file.Files.newByteChannel(Files.java:373) ~[?:?]
    at java.nio.file.Files.newByteChannel(Files.java:424) ~[?:?]
    at java.nio.file.spi.FileSystemProvider.newInputStream(FileSystemProvider.java:420) ~[?:?]
    at java.nio.file.Files.newInputStream(Files.java:158) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.TrustConfig.getStore(TrustConfig.java:95) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.StoreTrustConfig.createTrustManager(StoreTrustConfig.java:65) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.createSslContext(SSLService.java:384) ~[?:?]
    at java.util.HashMap.computeIfAbsent(HashMap.java:1133) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadConfiguration(SSLService.java:446) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.loadSSLConfigurations(SSLService.java:430) ~[?:?]
    at org.elasticsearch.xpack.core.ssl.SSLService.<init>(SSLService.java:121) ~[?:?]
    at org.elasticsearch.xpack.core.XPackPlugin.<init>(XPackPlugin.java:142) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) ~[?:?]
    at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
    at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500) ~[?:?]
    at java.lang.reflect.Constructor.newInstance(Constructor.java:481) ~[?:?]
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:605) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundle(PluginsService.java:556) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.loadBundles(PluginsService.java:471) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:163) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:311) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.node.Node.<init>(Node.java:255) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:221) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.4.1.jar:7.4.1]
    at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) ~[elasticsearch-7.4.1.jar:7.4.1]

[elasticsearch@ws-elk-cluster01:/usr/local/tom/elasticsearch-7.4.1]$ cat config/elasticsearch.yml
#集群的名称
cluster.name: es_cluster  
##节点的名称，每台机器配置都不相同
node.name: es_node_03
##数据存放路径
path.data: /usr/local/tom/es/data
##日志存放路径
path.logs: /usr/local/tom/es/logs
#锁定内存，不让JVM写swap，禁止操作系统交换出去，避免性能降低。
bootstrap.memory_lock: true
##节点的IP地址，最好配置为内网IP
network.host: 1.1.1.194
#
http.port: 9200
#是否有资格成为主节点，如果节点是数据节点或负载均衡节点就为False
node.master: true
#是否是数据节点，共三个节点中，第三个节点配置不存放数据，这里配置为false
node.data: true
## master和data同时配置会产生一些奇异的效果：
##      1) 当master为false，而data为true时，会对该节点产生严重负荷；
##       2) 当master为true，而data为false时，该节点作为一个协调者；
##       3) 当master为false，data也为false时，该节点就变成了一个负载均衡器。
##配置集群节点地址，配置后集群内的主机之间可以自动发现，建议配置为内网地址
##在7.0版本中不推荐使用旧的名称
##discovery.zen.ping.unicast.hosts替换为discovery.seed_hosts
##discovery.zen.hosts_provider 替换为 discovery.seed_providers
##discovery.zen.no_master_block 替换为 cluster.no_master_block
##discovery.seed_hosts: ["172.20.103.221", "172.20.103.222", "172.20.103.223"]
discovery.seed_hosts: ["1.1.1.192:9300", "1.1.1.193:9300", "1.1.1.194:9300"]
#
cluster.initial_master_nodes: ["1.1.1.192", "1.1.1.193", "1.1.1.194"]

#防止集群脑裂，设置最少主节点数目，通常为：(可成为主节点主机数目/2)+1,如 可称为主节点主机数目为7，结果设置为4
discovery.zen.minimum_master_nodes: 2
#配置最少几个节点恢复后，集群就正常工作
gateway.recover_after_nodes: 2

#设置节点之间交互的tcp端口，默认是9300。
transport.tcp.port: 9300
#设置是否压缩tcp传输时的数据，默认为false，不压缩。
transport.tcp.compress: true
#是否使用http协议对外提供服务，默认为true，开启。
#http.enabled: false
#
#数据备份的目录
path.repo: ["/usr/local/tom/bak_es/"]

#添加x-pack功能
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
#xpack.security.transport.ssl.keystore.path: /usr/local/tom/elasticsearch/config/elastic-certificates.p12
#xpack.security.transport.ssl.truststore.path: /usr/local/tom/elasticsearch/config/elastic-certificates.p12


xpack.security.transport.ssl.keystore.path: /usr/local/tom/elasticsearch-7.4.1/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/tom/elasticsearch-7.4.1/config/elastic-certificates.p12


# 搜索了一下有人说是/usr/local/tom/elasticsearch/config/elastic-certificates.p12 没有写入权限，chmod 777 /usr/local/tom/elasticsearch/config/elastic-certificates.p12 问题依旧

于是直觉性的改用绝对路径
#xpack.security.transport.ssl.keystore.path: /usr/local/tom/elasticsearch/config/elastic-certificates.p12
#xpack.security.transport.ssl.truststore.path: /usr/local/tom/elasticsearch/config/elastic-certificates.p12

改为
xpack.security.transport.ssl.keystore.path: /usr/local/tom/elasticsearch-7.4.1/config/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /usr/local/tom/elasticsearch-7.4.1/config/elastic-certificates.p12

# su elasticsearch
# cd /usr/local/tom/elasticsearch-7.4.1 && bin/elasticsearch -d

问题解决