配置独享型负载均衡

package org.example;

import java.io.ByteArrayInputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.security.KeyStore;
import java.security.SecureRandom;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Base64;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLHandshakeException;
import javax.net.ssl.TrustManagerFactory;

public class OpensearchDemo {
    private static final String TRUSTED_CA_PATH = "path\\ca.pem"; // CA证书路径
    private static final String PKCS12_PATH = "path\\client.p12"; // 客户端证书路径
    private static final String KEY_PASSWORD = ""; // 客户端证书密码
    private static final String HOST_NAME = ""; // ELB IP或域名
    private static final int PORT = 9200;  //ELB 端口
    private static final String ELB_URL = "https://" + HOST_NAME + ":" + PORT;
    private static final String OS_USER = ""; // Opensearch用户名
    private static final String OS_PASS = ""; // Opensearch用户名的密码
    public static void main(String[] args) throws Exception {
        // 1. 创建标准的 SSLContext
        SSLContext sslContext = createStrictMtlsSslContext();
        // 2. 注入 SSLContext
        HttpClient client = HttpClient.newBuilder()
            .sslContext(sslContext)
            .connectTimeout(java.time.Duration.ofSeconds(10))
            .build();
        String authHeader = getBasicAuthHeader(OS_USER, OS_PASS);
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(ELB_URL + "/_cat/indices?v"))
            .GET()
            .header("Accept", "application/json")
            .header("Authorization", authHeader)
            .build();
        try {
            // 发送请求
            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
            System.out.println("http statusCode: " + response.statusCode());
            System.out.println("response body:\n" + response.body());
        } catch (SSLHandshakeException e) {
            System.err.println("SSLHandshakeException: " + e.getMessage());
            e.printStackTrace();
        } catch (IOException e) {
            System.err.println("IOException: " + e.getMessage());
            e.printStackTrace();
        }
    }

    /**
     * 创建SSLContext
     */
    private static SSLContext createStrictMtlsSslContext() throws Exception {
        // --- 1. 准备 TrustStore (验证服务器) ---
        KeyStore trustStore = KeyStore.getInstance("PKCS12");
        trustStore.load(null, null);
        X509Certificate caCert = loadCertificate(TRUSTED_CA_PATH);
        trustStore.setCertificateEntry("ca-root", caCert);
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);
        // --- 2. 准备 KeyStore (客户端身份) ---
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        File p12File = new File(PKCS12_PATH);
        try (InputStream is = new FileInputStream(p12File)) {
            keyStore.load(is, KEY_PASSWORD.toCharArray());
        }
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(keyStore, KEY_PASSWORD.toCharArray());
        // --- 3. 初始化 SSLContext (标准模式) ---
        SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom());
        return sslContext;
    }

    private static X509Certificate loadCertificate(String path) throws Exception {
        try (InputStream is = new FileInputStream(path)) {
            String pem = new String(is.readAllBytes(), StandardCharsets.UTF_8);
            String base64 = pem.replace("-----BEGIN CERTIFICATE-----", "")
                .replace("-----END CERTIFICATE-----", "")
                .replaceAll("\\s+", "");
            byte[] der = Base64.getDecoder().decode(base64);
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            return (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(der));
        }
    }
    private static String getBasicAuthHeader(String user, String pass) {
        String auth = user + ":" + pass;
        String encoded = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
        return "Basic " + encoded;
    }
}

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.example</groupId>
    <artifactId>opensearch-demo</artifactId>
    <version>1.0</version>

    <properties>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.opensearch.client</groupId>
            <artifactId>opensearch-java</artifactId>
            <version>2.19.0</version>
        </dependency>

        <dependency>
            <groupId>org.opensearch.client</groupId>
            <artifactId>opensearch-rest-client</artifactId>
            <version>2.19.0</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
            <version>5.3.1</version>
        </dependency>

        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.17.0</version>
        </dependency>
    </dependencies>
</project>