在 Cloud Foundry 的 docker 中运行启用了 HTTPS 的 Spring Boot 应用程序答案

【问题标题】：Running Spring Boot application with HTTPS enabled in docker on cloud foundry在 Cloud Foundry 的 docker 中运行启用了 HTTPS 的 Spring Boot 应用程序
【发布时间】：2018-04-08 00:12:27
【问题描述】：

我创建了一个基于 Spring Boot 的应用程序，它的 application.yml 文件是这样的：

server:
  port: 8108
  tomcat:
    remote_ip_header: x-forwarded-for
    protocol_header: x-forwarded-proto

它也在 https 端口上运行。我在 Cloud Foundry 中部署了这个应用程序，它已成功部署并在 https url 上运行，并且运行良好。

现在我使用以下配置为这个应用程序创建了 dockerfile：

FROM frolvlad/alpine-oraclejdk8
VOLUME /tmp
ADD  <name-of-jar>.jar aap.jar
EXPOSE 8108
ENTRYPOINT ["java","-jar","/aap.jar"]

并使用以下命令在启用 docker 的情况下推送到 Cloud Foundry：

cf push -m 2g --docker-image /: --docker-用户名

它已成功部署并启动，但是当我尝试通过其 URL 访问它时：

https://

我得到以下异常：

 2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [            org.apache.tomcat.util.net.NioEndpoint]: Error during SSL handshake
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:156)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1411)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [            org.apache.tomcat.util.net.NioEndpoint]: Failed to close socket
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(SocketChannelImpl.java:270)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:518)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$Poller.cancelledKey(NioEndpoint.java:729)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:461)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:508)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.flush(SecureNioChannel.java:143)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.access$500(NioEndpoint.java:69)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.close(NioEndpoint.java:507)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.lang.Thread.run(Thread.java:748)
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT 12:33:52.488 [DEBUG] [                                ] [-exec-7] [         org.apache.tomcat.util.threads.LimitLatch]: Counting down[https-jsse-nio-8108-exec-7] latch=1
   2017-10-26T18:03:52.48+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.494 [DEBUG] [                                ] [-exec-8] [       org.apache.tomcat.util.net.SecureNioChannel]: The SNI host name extracted for this connection was [null]
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.494 [DEBUG] [                                ] [eptor-0] [         org.apache.tomcat.util.threads.LimitLatch]: Counting up[https-jsse-nio-8108-Acceptor-0] latch=1
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT 12:33:52.495 [DEBUG] [                                ] [-exec-8] [            org.apache.tomcat.util.net.NioEndpoint]: Error during SSL handshake
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.EngineInputRecord.bytesInCompletePacket(EngineInputRecord.java:156)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:232)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.handshakeUnwrap(SecureNioChannel.java:459)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1411)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.lang.Thread.run(Thread.java:748)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT java.nio.channels.ClosedChannelException: null
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.ensureWriteOpen(SocketChannelImpl.java:270)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.flush(SecureNioChannel.java:143)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at sun.nio.ch.SocketChannelImpl.write(SocketChannelImpl.java:461)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:508)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SecureNioChannel.close(SecureNioChannel.java:518)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint$Poller.cancelledKey(NioEndpoint.java:729)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.NioEndpoint.close(NioEndpoint.java:507)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
   2017-10-26T18:03:52.49+0530 [APP/PROC/WEB/0] OUT     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

为了在我的 dockerfile EXPOSE 部分中解决这个问题，我提到了 443 端口，而不是它已经运行的端口，但是 docker 部署失败并报告 443 端口错误。

【问题讨论】：

标签： java docker spring-boot dockerfile cloud-foundry

【解决方案1】：

javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection? 和 Error during SSL handshake 看起来您的应用正在侦听 HTTPS 请求，但传入的请求不是 HTTPS（见下文）。查看您的应用程序的配置以了解原因。我没有看到您发布的配置位表明启用 HTTPS 的原因，但这是通常会为 Spring Boot 应用程序启用 HTTPS 的配置。

https://docs.spring.io/spring-boot/docs/current/reference/html/howto-embedded-servlet-containers.html#howto-configure-ssl

对于 Cloud Foundry，您的应用程序应侦听 HTTP 请求。目前，外部负载均衡器或 GoRouter 将终止 HTTPS 请求并通过 HTTP 与所有应用程序通信。

https://docs.cloudfoundry.org/concepts/http-routing.html#tls

如果您希望将 TLS/HTTPS 直接连接到您的应用程序，那么您目前需要使用 TCP 路由。

https://docs.cloudfoundry.org/adminguide/enabling-tcp-routing.html#ports

希望有帮助！

【讨论】：