Spring Security集成Keycloak遇X509证书Issuer DN为空错误求助

针对你遇到的java.security.cert.CertificateParsingException: Empty issuer DN not allowed in X509Certificates错误，按以下步骤排查：

1. 修正cert-manager的证书配置 #

cert-manager生成自签证书时，必须明确配置完整的Issuer DN字段，不能仅指定commonName。补充subject下的组织、地区等必填项，示例配置：

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned-cluster-issuer
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: keycloak-cert
  namespace: keycloak
spec:
  secretName: keycloak-tls
  issuerRef:
    name: selfsigned-cluster-issuer
    kind: ClusterIssuer
  commonName: keycloak.keycloak.svc.cluster.local
  dnsNames:
    - keycloak.keycloak.svc.cluster.local
    - keycloak.local
  subject:
    organizations:
      - YourOrg
    countries:
      - CN
    localities:
      - YourCity
    organizationalUnits:
      - YourTeam

重新生成证书后，确保Issuer DN不为空。

2. 验证证书的Issuer信息 #

从K3D集群导出证书并检查Issuer字段：

# 导出证书文件
kubectl get secret keycloak-tls -n keycloak -o jsonpath='{.data.tls\.crt}' | base64 -d > keycloak.crt
# 查看Issuer详情
openssl x509 -in keycloak.crt -noout -issuer

输出需包含完整的Issuer信息，例如：issuer= /C=CN/O=YourOrg/OU=YourTeam/L=YourCity/CN=keycloak.keycloak.svc.cluster.local，若为空则说明配置仍有问题。

3. 检查证书转换命令的正确性 #

确保转换keystore/truststore时包含完整证书链，命令示例：

# 转换为PKCS12格式，再转JKS keystore
openssl pkcs12 -export -in keycloak.crt -inkey keycloak.key -out keystore.p12 -name keycloak -CAfile ca.crt -caname root
keytool -importkeystore -deststorepass changeit -destkeystore keystore.jks -srckeystore keystore.p12 -srcstoretype PKCS12

# 生成truststore
keytool -import -alias keycloak -file keycloak.crt -keystore truststore.jks -storepass changeit -noprompt

注意：若使用自签证书，需将根CA证书也导入truststore，避免证书链不完整。

4. 校验Spring Boot的SSL配置 #

确保application.yml中SSL参数配置正确，包含证书类型、路径和密码：

server:
  ssl:
    key-store: classpath:keystore.jks
    key-store-password: changeit
    key-store-type: JKS
    trust-store: classpath:truststore.jks
    trust-store-password: changeit
    trust-store-type: JKS

spring:
  security:
    oauth2:
      client:
        provider:
          keycloak:
            issuer-uri: https://keycloak.keycloak.svc.cluster.local/auth/realms/your-realm
        registration:
          keycloak:
            client-id: your-client-id
            client-secret: your-client-secret
            scope: openid,profile,email

5. 确认JVM证书解析兼容性 #

部分JVM版本对X509证书的DN格式要求严格，需确保证书符合RFC5280规范，自签证书的Issuer和Subject需保持一致。

内容的提问来源于stack exchange，提问作者Varun Khatri