我从这里使用标准的Docker映像:https://hub.docker.com/r/jboss/keycloak/
然后我运行以下命令来构建它:
docker run \
-v /etc/letsencrypt/live/ds-gym.de/fullchain.pem:/etc/x509/https/fullchain.pem \
-v /etc/letsencrypt/live/ds-gym.de/privatekey.pem:/etc/x509/https/privatekey.pem \
-e KEYCLOAK_USER=myadmin \
-e KEYCLOAK_PASSWORD=mypassword \
-p 8443:8443 jboss/keycloak
不幸的是,我收到以下错误:
错误[io.undertow.request](默认I / O-1)在关闭SSLConduit之后 握手异常:javax.net.ssl.SSLHandshakeException:无密码 共同的套房
我是否必须将文件转换为.crt
和.key?
,我认为这没关系。我该如何解决这个问题?
答案 0 :(得分:3)
似乎Keycloak没有使用您提供的私钥和证书。它们应以tls.key
和tls.crt
的形式提供
因此,相应地更改坐骑就足够了:
-v /etc/letsencrypt/live/ds-gym.de/fullchain.pem:/etc/x509/https/tls.crt \
-v /etc/letsencrypt/live/ds-gym.de/privatekey.pem:/etc/x509/https/tls.key \
我的keycloak实例也使用最新的keycloak版本和LetsEncrypt运行,没有任何问题
编辑:
我的docker-compose设置,也许可以帮助您调试。
$ ls -l
-rw-r--r-- 1 user 197121 904 Dez 22 13:28 docker-compose.yml
-rw-r--r-- 1 user 197121 3566 Dez 22 13:28 fullchain.pem
-rw-r--r-- 1 user 197121 1708 Dez 22 13:28 privatekey.pem
docker-compose.yml
version: "3.7"
services:
mysql:
image: mysql:5.7
volumes:
- mysql_data:/var/lib/mysql
ports:
- 3306:3306
environment:
MYSQL_ROOT_PASSWORD: root
MYSQL_DATABASE: keycloak
MYSQL_USER: keycloak
MYSQL_PASSWORD: password
keycloak:
image: jboss/keycloak
ports:
- 8443:8443
environment:
PROXY_ADDRESS_FORWARDING: "true"
DB_VENDOR: MYSQL
DB_ADDR: mysql
DB_DATABASE: keycloak
DB_USER: keycloak
DB_PASSWORD: password
KEYCLOAK_USER: admin
KEYCLOAK_PASSWORD: admin
JDBC_PARAMS: "useSSL=false"
volumes:
- mysql_data:/opt/jboss/mysql_data
- ./fullchain.pem:/etc/x509/https/tls.crt
- ./privatekey.pem:/etc/x509/https/tls.key
depends_on:
- mysql
links:
- mysql
volumes:
mysql_data:
driver: local
启动密钥斗篷后,我可以通过SSL连接到它
$ curl -v 'https://localhost:8443'
0* Connected to localhost (127.0.0.1) port 8443 (#0)
...
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: CN=mydomain.com
* start date: 2019-10-29 01:25:18 GMT
* expire date: 2020-01-27 01:25:18 GMT
* subjectAltName does not match localhost
* SSL: no alternative certificate subject name matches target host name 'localhost'
* Closing connection 0
} [5 bytes data]
* TLSv1.2 (OUT), TLS alert, Client hello (1):
} [2 bytes data]
curl: (51) SSL: no alternative certificate subject name matches target host name 'localhost'
SSL总体上是有效的,只是失败了,因为LetsEnctypt-certificate对本地主机无效:-)