签名XML在Windows环境可正常发送，为何在Linux Docker环境无法运行？

It's a classic scenario—your WS-Secured SOAP request with XML signature works flawlessly on Windows, but fails when deployed in a Linux Docker container. These cross-environment signature failures almost always boil down to differences in XML processing, certificate handling, or signature calculation between the two environments. Let's break down the most likely causes and how to investigate them:

1. Line Ending Differences in XML Canonicalization #

Windows uses \r\n for line breaks, while Linux uses \n. Your signature relies on the http://www.w3.org/2001/10/xml-exc-c14n# canonicalization algorithm, which treats line endings differently—this directly impacts the digest value calculated for signing.

• Investigation Steps:
  • Capture the SOAP XML just before it's sent in both environments, then compare the line endings. On Linux, use cat -A to see hidden line break characters.
  • Check your SOAP client library (like Apache CXF, Spring WS, etc.) for configuration options to enforce consistent line endings during canonicalization. Many libraries default to OS-specific line breaks, so you'll need to explicitly set this to a fixed value (e.g., \n).

2. Certificate Loading & Path Permissions #

Windows and Linux have completely different certificate storage systems, and Docker containers often introduce path or permission issues:

• Investigation Steps:
  • Verify that the private key and certificate files are correctly loaded in the Docker container. Check file paths are accurate, and the container's runtime user has read permissions (use ls -l to inspect permissions).
  • If using Java KeyStores, confirm the format (e.g., JKS vs PKCS12) is compatible across environments. JKS is Windows-friendly, but PKCS12 is more cross-platform—consider converting your keystore if needed.
  • Ensure the full certificate chain is present. Windows may automatically resolve root CA certificates, but Docker containers often have a minimal trust store. Missing root CAs will cause the server to reject the signature.

3. System Time & Timezone Mismatches #

While your request doesn't show a timestamp, many SOAP clients add them by default for WS-Security. If the Docker container's system time or timezone is out of sync with Windows, this can trigger signature validation failures on the server.

• Investigation Steps:
  • Run date in the Docker container to compare with your Windows system time—ensure the difference is within the server's allowed tolerance (usually a few minutes).
  • Configure the container to use the correct timezone, e.g., by mounting the host's timezone file: -v /etc/localtime:/etc/localtime:ro.

4. SOAP Client Library & Dependency Version Differences #

A mismatch in SOAP client or XML processing library versions between Windows and Docker can lead to inconsistent signature calculations:

• Investigation Steps:
  • Compare dependency trees (e.g., Maven dependency:tree or Gradle dependencies) across both environments. Ensure versions of core libraries (like XML Security for Java, Xerces, etc.) are identical.
  • Check the JVM version if using Java—some JVM versions have subtle differences in default XML parsers that can affect signature logic.

5. Network Proxy/Firewall Modifications #

Docker containers often run behind proxies or firewalls that may alter the SOAP request content (e.g., adding/removing whitespace, reformatting XML), which breaks the signature.

• Investigation Steps:
  • Capture the actual request sent from the Docker container using tools like curl or tcpdump, then compare it byte-for-byte with the working Windows request.
  • Verify no network devices are modifying the XML payload before it reaches the server.

Start your troubleshooting with XML canonicalization and certificate loading—these are the most frequent culprits for cross-environment signature issues. If you can get access to the server's error logs, that will be invaluable (e.g., is the error "signature validation failed", "untrusted certificate", or "malformed XML"?).

内容的提问来源于stack exchange，提问作者Jigar Bhanushali