Question

我从这里使用标准的Docker映像：https://hub.docker.com/r/jboss/keycloak/

然后我运行以下命令来构建它：

docker run \
 -v /etc/letsencrypt/live/ds-gym.de/fullchain.pem:/etc/x509/https/fullchain.pem \
 -v /etc/letsencrypt/live/ds-gym.de/privatekey.pem:/etc/x509/https/privatekey.pem \
 -e KEYCLOAK_USER=myadmin \
 -e KEYCLOAK_PASSWORD=mypassword \
 -p 8443:8443 jboss/keycloak

不幸的是，我收到以下错误：

错误[io.undertow.request]（默认I / O-1）在关闭SSLConduit之后握手异常：javax.net.ssl.SSLHandshakeException：无密码共同的套房

我是否必须将文件转换为.crt和.key?，我认为这没关系。我该如何解决这个问题？

Answer 1

似乎Keycloak没有使用您提供的私钥和证书。它们应以tls.key和tls.crt的形式提供因此，相应地更改坐骑就足够了：

-v /etc/letsencrypt/live/ds-gym.de/fullchain.pem:/etc/x509/https/tls.crt \
-v /etc/letsencrypt/live/ds-gym.de/privatekey.pem:/etc/x509/https/tls.key \

我的keycloak实例也使用最新的keycloak版本和LetsEncrypt运行，没有任何问题

编辑：

我的docker-compose设置，也许可以帮助您调试。

$ ls -l
-rw-r--r-- 1 user 197121  904 Dez 22 13:28 docker-compose.yml
-rw-r--r-- 1 user 197121 3566 Dez 22 13:28 fullchain.pem
-rw-r--r-- 1 user 197121 1708 Dez 22 13:28 privatekey.pem

docker-compose.yml

version: "3.7"

services:
  mysql:
    image: mysql:5.7
    volumes:
       - mysql_data:/var/lib/mysql
    ports:
       - 3306:3306
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: keycloak
      MYSQL_USER: keycloak
      MYSQL_PASSWORD: password

  keycloak:
    image: jboss/keycloak
    ports:
       - 8443:8443
    environment:
      PROXY_ADDRESS_FORWARDING: "true"
      DB_VENDOR: MYSQL
      DB_ADDR: mysql
      DB_DATABASE: keycloak
      DB_USER: keycloak
      DB_PASSWORD: password
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      JDBC_PARAMS: "useSSL=false"
    volumes:
      - mysql_data:/opt/jboss/mysql_data
      - ./fullchain.pem:/etc/x509/https/tls.crt
      - ./privatekey.pem:/etc/x509/https/tls.key
    depends_on:
      - mysql
    links:
      - mysql

volumes:
  mysql_data:
    driver: local

启动密钥斗篷后，我可以通过SSL连接到它

$ curl -v 'https://localhost:8443'
0* Connected to localhost (127.0.0.1) port 8443 (#0)
...
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*        subject: CN=mydomain.com
*        start date: 2019-10-29 01:25:18 GMT
*        expire date: 2020-01-27 01:25:18 GMT
*        subjectAltName does not match localhost
* SSL: no alternative certificate subject name matches target host name 'localhost'
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]
curl: (51) SSL: no alternative certificate subject name matches target host name 'localhost'

SSL总体上是有效的，只是失败了，因为LetsEnctypt-certificate对本地主机无效：-）

Docker和Letsencrypt证书的Keycloak错误

1 个答案: