java - 在 Cloud Foundry 上的 docker 中启用 HTTPS 来运行 Spring Boot 应用程序

Question

我创建了一个基于 spring boot 的应用程序，它的 application.yml 文件是这样的:

server:
  port: 8108
  tomcat:
    remote_ip_header: x-forwarded-for
    protocol_header: x-forwarded-proto

它也在 https 端口上运行。我在 Cloud Foundry 中部署了此应用程序，它已成功部署并在 https url 上运行，并且工作正常。

现在我使用以下配置为此应用程序创建了 dockerfile:

FROM frolvlad/alpine-oraclejdk8
VOLUME /tmp
ADD  <name-of-jar>.jar aap.jar
EXPOSE 8108
ENTRYPOINT ["java","-jar","/aap.jar"]

并使用以下命令将其推送到启用了 docker 的 Cloud Foundry:

cf push -m 2g --docker-image /: --docker-username

它已成功部署并启动，但是当我尝试通过其 URL 访问它时:

https://

我得到以下异常:

 2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [            org.apache.tomcat.util.net.NioEndpoint]: Error during SSL handshake
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:156)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1411)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [            org.apache.tomcat.util.net.NioEndpoint]: Failed to close socket
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(SocketChannelImpl.java:270)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:518)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$Poller.cancelledKey(NioEndpoint.java:729)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:461)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:508)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.flush(SecureNioChannel.java:143)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.access$500(NioEndpoint.java:69)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.close(NioEndpoint.java:507)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.lang.Thread.run(Thread.java:748)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [         org.apache.tomcat.util.threads.LimitLatch]: Counting down[https-jsse-nio-8108-exec-7] latch=1
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.494 [DEBUG] [                                ] [-exec-8] [       org.apache.tomcat.util.net.SecureNioChannel]: The SNI host name extracted for this connection was [null]
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.494 [DEBUG] [                                ] [eptor-0] [         org.apache.tomcat.util.threads.LimitLatch]: Counting up[https-jsse-nio-8108-Acceptor-0] latch=1
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.495 [DEBUG] [                                ] [-exec-8] [            org.apache.tomcat.util.net.NioEndpoint]: Error during SSL handshake
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:156)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:232)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.handshakeUnwrap(SecureNioChannel.java:459)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1411)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.lang.Thread.run(Thread.java:748)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT java.nio.channels.ClosedChannelException: null
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(SocketChannelImpl.java:270)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.flush(SecureNioChannel.java:143)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:461)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:508)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:518)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$Poller.cancelledKey(NioEndpoint.java:729)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.close(NioEndpoint.java:507)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

为了在我的 dockerfile EXPOSE 部分中解决此问题，我提到了 443 端口(除了已运行的端口之外)，但 docker 部署失败并报告 443 端口错误。

Answer 1

javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection? 和 SSL 握手期间出错 看起来您的应用正在监听 HTTPS 请求，但传入的请求不是 HTTPS(见下文)。查看应用程序的配置以了解原因。我没有看到您发布的配置中的任何内容可以表明为什么启用 HTTPS，但这是通常为 Spring Boot 应用程序启用 HTTPS 的配置。

https://docs.spring.io/spring-boot/docs/current/reference/html/howto-embedded-servlet-containers.html#howto-configure-ssl

对于 Cloud Foundry，您的应用程序应该监听 HTTP 请求。目前，外部负载均衡器或 GoRouter 将终止 HTTPS 请求并通过 HTTP 与所有应用程序通信。

https://docs.cloudfoundry.org/concepts/http-routing.html#tls

如果您希望 TLS/HTTPS 直接连接到您的应用程序，那么您当前需要使用 TCP 路由。

https://docs.cloudfoundry.org/adminguide/enabling-tcp-routing.html#ports

希望有帮助!