ssl - 设置 SSL 后，Keycloak 在 https 上不起作用

Question

我有一个问题，我不知道为什么会这样。

我有用于创建 .pfx 文件的 LetsEncrypt 证书。

openssl pkcs12 -export -out /tmp/certificate.pfx -inkey /etc/letsencrypt/live/ds-gym.de/privkey.pem -in /etc/letsencrypt/live/ds-gym.de/cert.pem -certfile /etc/letsencrypt/live/ds-gym.de/chain.pem

我设置了 keycloak 8.0.1。按照本教程 ( https://medium.com/@hasnat.saeed/setup-keycloak-server-on-ubuntu-18-04-ed8c7c79a2d9 ) 作为服务，它运行良好。 Keycloak 似乎设置了一个自签名证书，这不是我想要的。首先，我为 SSL 设置了 Keycloak。

我使用 JBoss-cli.sh 文件执行以下操作(此处描述:https://www.keycloak.org/docs/latest/server_installation/#setting-up-https-ssl)

    /core-service=management/security-realm=UndertowRealm:add()
    /core-service=management/security-realm=UndertowRealm/server-identity=ssl:add(keystore-path=keycloak.jks, keystore-relative-to=jboss.server.config.dir, keystore-password=secret)
/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=security-realm, value=UndertowRealm)

不是我的安全团队看起来像这样:

    <security-realm name="UndertowRealm">
        <server-identities>
            <ssl>
                <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret"/>
            </ssl>
        </server-identities>
    </security-realm>

我现在导入证书:

keytool -importkeystore -srckeystore /tmp/certificate.pfx -srcstoretype pkcs12 -destkeystore /opt/keycloak/standalone/configuration/keycloak.jks -deststoretype JKS

然后我重新启动keycloak:

systemctl restart keycloak

现在我得到以下错误:

HTTP ERROR 502

如果有帮助，您还可以查看我网站的网络选项卡。

keycloak 服务已启动并正在运行，但它似乎不再适用于端口 8443。

听众看起来像这样:

    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
        <https-listener name="https" socket-binding="https" security-realm="UndertowRealm" enable-http2="true"/>
        <host name="default-host" alias="localhost">
            <location name="/" handler="welcome-content"/>
            <http-invoker security-realm="ApplicationRealm"/>
        </host>
    </server>

知道为什么会这样吗？我的证书错了吗？我已经对 Keycloak 感到非常绝望了:-(

编辑:

这是我记录的错误:

]) - failure description: {"WFLYCTL0080: Failed services" => {"org.wildfly.core.management.security.realm.UndertowRealm.key-manager" => "WFLYDM0018: Unable to start service Caused by: java.security.UnrecoverableKeyException: Cannot recover key"}} 2019-12-23 19:12:57,421 INFO [org.jboss.as.server] (ServerService Thread Pool -- 43) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war") 2019-12-23 19:12:57,423 INFO [org.jboss.as.controller] (Controller Boot Thread) WFLYCTL0183: Service status report WFLYCTL0186:
Services which failed to start: service org.wildfly.core.management.security.realm.UndertowRealm.key-manager: WFLYDM0018: Unable to start service WFLYCTL0448: 2 additional services are down due to their dependencies being missing or failed 2019-12-23 19:12:57,569 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0212: Resuming server 2019-12-23 19:12:57,578 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http management interface listening on http://127.0.0.1:9990/management 2019-12-23 19:12:57,579 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990 2019-12-23 19:12:57,580 ERROR [org.jboss.as] (Controller Boot Thread) WFLYSRV0026: Keycloak 8.0.1 (WildFly Core 10.0.3.Final) started (with errors) in 41093ms - Started 586 of 888 services (4 services failed or missing dependencies, 604 services are lazy, passive or on-demand)

Answer 1

看起来 keystore 生成不正确。检查:

• 您设置 keystore-password 的值以匹配实际的 keystore 密码。
• 您为根证书设置了别名 root。
• 您为域证书设置别名 yourdomain.com。

尝试完全按照文档中描述的步骤进行操作。