Docker部署Spring Boot+Azure IDP遇SSLHandshakeException问题求助

将Azure IDP与Spring Boot集成实现单点登录后，本地或Windows服务部署时运行正常，但部署到Docker环境时抛出SSL异常，具体信息及配置如下：

应用配置（application.yml） #

security:
    oauth2:
      client:
        provider:
          azure:
            issuer-uri: https://login.microsoftonline.com/<<tenet id>>/v2.0
        registration:
          azure-dev:
            provider: azure
            client-id: <<client id>>
            client-secret: <<secret>>
            redirect-uri: https://>>system name>>:9443/app/login/oauth2/code/azure-dev
            scope:
              - openid
              - email
              - profile

安全配置类片段 #

.oauth2Login(oauthLogin -> oauthLogin
                        .userInfoEndpoint(userInfo -> userInfo.oidcUserService(getAuthUserService())))

Dockerfile内容 #

FROM registry.access.redhat.com/ubi9/openjdk-17-runtime:1.20-2.1719294801

USER root
# Install CA certificates and curl
#RUN microdnf update && microdnf install -y ca-certificates curl openssl

# Set the working directory
WORKDIR /app

RUN mkdir -p /app/java /app/config  /usr/local/share/ca-certificates\
    && chgrp -R root /app /app/config /app/java /usr/local/share/ca-certificates \
    && chmod -R 770 /app /app/config /usr/local/share/ca-certificates \
    && chmod -R 777 /app/java /usr/local/share/ca-certificates

COPY spring-security-azuread-3.2.1.jar /app/spring-security-azuread-3.2.1.jar

# Copy the concatenated certificate file into the container
COPY azure-idp-cert-chain.pem /usr/local/share/ca-certificates/azure-idp-cert-chain.pem

# Import the certificate chain into the Java truststore
RUN keytool -importcert -noprompt -trustcacerts -alias ca-chain \
    -file /usr/local/share/ca-certificates/azure-idp-cert-chain.pem \
    -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit

EXPOSE 9443
EXPOSE 8080

# Set a default command for debugging purposes
CMD ["java", "-jar", "/app/spring-security-azuread-3.2.1.jar"]

报错信息 #

[invalid_token_response] An error occurred while attempting to
retrieve the OAuth 2.0 Access Token Response: I/O error on POST
request for
"https://login.microsoftonline.com/0ae51e19-07c8-4e4b-bb6d-648ee58410f4/oauth2/v2.0/token":
PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target

已尝试操作 #

• 已正确设置JAVA_HOME
• 已导入DigiCertGlobalRootCA、DigiCertGlobalRootG2、MicrosoftECC2017、MicrosoftRSA2017证书及login.microsoftonline.com相关证书
• Windows环境下未导入任何证书即可正常运行，RedHat JDK/Java环境下失败

排查与解决建议 #

• 验证证书导入结果：
  进入运行中的容器，执行命令keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit | grep "ca-chain"，确认证书是否成功导入到Java默认信任库。如果无输出，检查azure-idp-cert-chain.pem是否正确复制到容器内，路径是否与导入命令一致。
• 启用系统证书同步：
  取消Dockerfile中安装CA证书的注释（RUN microdnf update && microdnf install -y ca-certificates curl openssl），添加RUN update-ca-trust extract命令同步系统证书，然后修改Java启动参数，让其使用系统证书库：CMD ["java", "-Djavax.net.ssl.trustStore=/etc/pki/java/cacerts", "-jar", "/app/spring-security-azuread-3.2.1.jar"]。
• 确认证书链完整性：
  用openssl s_client -connect login.microsoftonline.com:443 -showcerts命令获取完整的证书链，将所有证书按顺序（服务器证书在前，根CA在后）保存为pem文件，替换原azure-idp-cert-chain.pem后重新构建镜像。
• 检查信任库路径正确性：
  部分RedHat镜像中$JAVA_HOME指向JRE路径，确认$JAVA_HOME/lib/security/cacerts是否存在，若不存在，尝试使用$JAVA_HOME/jre/lib/security/cacerts作为信任库路径重新导入。
• 使用自定义信任库：
  若默认信任库导入不生效，可在Dockerfile中创建自定义信任库：

  RUN keytool -importcert -noprompt -trustcacerts -alias ca-chain \
      -file /usr/local/share/ca-certificates/azure-idp-cert-chain.pem \
      -keystore /app/config/custom-cacerts -storepass changeit
  

  启动时指定自定义信任库参数：CMD ["java", "-Djavax.net.ssl.trustStore=/app/config/custom-cacerts", "-Djavax.net.ssl.trustStorePassword=changeit", "-jar", "/app/spring-security-azuread-3.2.1.jar"]

内容的提问来源于stack exchange，提问作者Nishu