为提高效率,提问时请提供以下信息,问题描述清晰可优先响应。
【DM版本】:DM Database Server 64 V8 03134284294-20241009-244896-20119
【操作系统】:Windows 10 企业版
【CPU】:Intel(R) Core(TM) i5-10400 CPU @ 2.90GHz 2.90 GHz
【问题描述】*:
ENABLE_ENCRYPT = 3 #Encrypt Mode For Communication, 0: Without Encryption; 1: SSL Encryption; 2: Only SSL Authentication; 3: GmSSL; 4: Only SSL Encryption
我们项目在适配,通信加密
把该选项改成 3 然后启动不了,日志如下:我需要怎么配置,其中server_ssl中的证书换成了已经换成国密证书.
详细的配置步骤:
通过gmssl(3.3.1版本) 生成国密证书:下面是生成脚本,证书密码为 1234
gmssl sm2keygen -pass 1234 -out root-ca-key.pem gmssl certgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN ROOTCA -days 3650 -key root-ca-key.pem -pass 1234 -out root-ca-cert.pem -key_usage keyCertSign -key_usage cRLSign gmssl certparse -in root-ca-cert.pem gmssl sm2keygen -pass 1234 -out ca-key.pem gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN "Sub CA" -key ca-key.pem -pass 1234 -out ca-req.pem gmssl reqsign -in ca-req.pem -days 365 -key_usage keyCertSign -path_len_constraint 0 -cacert root-ca-cert.pem -key root-ca-key.pem -pass 1234 -out ca-cert.pem gmssl sm2keygen -pass 1234 -out server_enckey.pem gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key server_enckey.pem -pass 1234 -out server_encreq.pem gmssl reqsign -in server_encreq.pem -days 365 -key_usage digitalSignature -cacert ca-cert.pem -key ca-key.pem -pass 1234 -out server_enccert.pem gmssl sm2keygen -pass 1234 -out server_signkey.pem gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key server_signkey.pem -pass 1234 -out server_signreq.pem gmssl reqsign -in server_signreq.pem -days 365 -key_usage keyEncipherment -cacert ca-cert.pem -key ca-key.pem -pass 1234 -out server_signcert.pem gmssl sm2keygen -pass 1234 -out client_enckey.pem gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key client_enckey.pem -pass 1234 -out client_encreq.pem gmssl reqsign -in client_encreq.pem -days 365 -key_usage digitalSignature -cacert ca-cert.pem -key ca-key.pem -pass 1234 -out client_enccert.pem gmssl sm2keygen -pass 1234 -out client_signkey.pem gmssl reqgen -C CN -ST Beijing -L Haidian -O PKU -OU CS -CN localhost -key client_signkey.pem -pass 1234 -out client_signreq.pem gmssl reqsign -in client_signreq.pem -days 365 -key_usage keyEncipherment -cacert ca-cert.pem -key ca-key.pem -pass 1234 -out client_signcert.pem
把所有证书拷贝到:
安装目录下bin\server_ssl
通过命令行启动:
D:\dmdbms\bin>dmserver.exe path=D:\dmdbms\data\DAMENG\dm.ini signkey_pass=1234 enckey_pass=1234
报错:
D:\dmdbms\bin>dmserver.exe path=D:\dmdbms\data\DAMENG\dm.ini signkey_pass=1234 enckey_pass=1234
file dm.key not found, use default license!
version info: develop
csek2_vm_t = 1344
nsql_vm_t = 328
prjt2_vm_t = 176
ltid_vm_t = 216
nins2_vm_t = 1128
nset2_vm_t = 272
ndlck_vm_t = 192
ndel2_vm_t = 776
slct2_vm_t = 208
nli2_vm_t = 192
aagr2_vm_t = 280
pscn_vm_t = 288
dist_vm_t = 896
DM Database Server 64 V8 03134284294-20241009-244896-20119 startup...
Normal of FAST
Normal of DEFAULT
Normal of RECYCLE
Normal of KEEP
Normal of ROLL
Database mode = 0, oguid = 0
License will expire on 2025-10-09
SSL encrypt fail!
这个可以配置吗?哪位大牛指导一下
改成1或2试下呢