Docker部署NextJS13+Golang应用出现SSL_ERROR_RX_RECORD_TOO_LONG错误排查

• 本地非Docker环境下，使用自签名证书的NextJS 13前端与Golang后端可通过HTTPS正常运行
• Docker部署后出现两个问题：
  1. 访问https://127.0.0.1:3000时触发SSL_ERROR_RX_RECORD_TOO_LONG错误
  2. HTTP访问前端（http://127.0.0.1:3000）能正常启动，但无法连接Docker中运行的HTTPS后端

Docker Compose 文件 #

version: '3.9'

services:
  frontend:
    container_name: frontend
    image: frontend
    build:
      context: ./frontend
      dockerfile: frontend.dockerfile
    ports:
      - '3000:3000'
    environment:
      - NEXT_PUBLIC_API_URL=https://127.0.0.1:8080
    restart: always
    depends_on:
      - backend
  backend:
    container_name: backend
    image: backend
    build:
      context: .
      dockerfile: backend/backend.dockerfile
    ports:
      - "8080:8080"

前端 Dockerfile #

FROM node:21-alpine as build

WORKDIR /app

COPY package*.json ./

RUN npm install

COPY . .

RUN npm run build

FROM node:21-alpine

WORKDIR /app

COPY --from=build /app/package*.json ./

RUN npm install --only=production

COPY --from=build /app/.next ./.next
COPY --from=build /app/public ./public

COPY --from=build /app/certificates/localhost-key.pem ./certificates/
COPY --from=build /app/certificates/localhost.pem ./certificates/

EXPOSE 3000

CMD ["npm", "start"]

后端 Dockerfile #

FROM golang:1.21 AS build

WORKDIR /app

COPY backend/go.mod backend/go.sum ./

RUN go mod download

COPY backend/ .

RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o main ./server.go

FROM alpine:latest

RUN apk --no-cache add ca-certificates

WORKDIR /root/

COPY --from=build /app/main .
COPY --from=build /app/config config/
COPY --from=build /app/logger logger/
COPY --from=build /app/pkg/database/media pkg/database/media/
COPY tls/ /tls/

EXPOSE 8080

CMD ["./main"]

next.config.js #

/** @type {import('next').NextConfig} */
const nextConfig = {
  output: 'standalone' 
}

module.exports = {
  ...nextConfig, 
  images: {
    domains: ['127.0.0.1'], 
    remotePatterns: [
      {
        protocol: 'https', 
        hostname: 'i.ibb.co', 
        port: '', 
        pathname: '**', 
      },
      {
        protocol: 'https', 
        hostname: '127.0.0.1', 
        port: '', 
        pathname: '/**', 
      },
    ],
  },
}

问题1：SSL_ERROR_RX_RECORD_TOO_LONG 错误 #

该错误核心原因是：客户端用HTTPS协议请求端口3000，但前端容器内的NextJS服务默认以HTTP模式启动，未加载SSL证书监听HTTPS连接。

解决步骤：

1. 修改前端启动命令，让NextJS启用HTTPS并加载自签证书。直接修改前端Dockerfile的CMD：

   CMD ["npm", "run", "start:https"]
   

   同时在前端项目的package.json中添加对应启动脚本：

   "scripts": {
     "start": "next start",
     "start:https": "next start --experimental-https --experimental-https-key certificates/localhost-key.pem --experimental-https-cert certificates/localhost.pem"
   }
   

2. 当前Dockerfile已将证书复制到./certificates/目录，路径无需调整，确保证书文件存在即可。

问题2：HTTP前端无法连接Docker中的HTTPS后端 #

主要存在两个问题：容器间通信地址错误、自签证书不被信任。

解决步骤：

1. 修正容器间通信地址：
   Docker Compose中服务名可作为内部域名解析，将前端环境变量NEXT_PUBLIC_API_URL改为容器间通信地址：

   environment:
     - NEXT_PUBLIC_API_URL=https://backend:8080
   

2. 解决自签证书信任问题：
   将自签证书添加到前端容器的系统信任库，修改前端Dockerfile的生产阶段：

   FROM node:21-alpine
   
   WORKDIR /app
   
   COPY --from=build /app/package*.json ./
   
   RUN npm install --only=production
   
   COPY --from=build /app/.next ./.next
   COPY --from=build /app/public ./public
   
   COPY --from=build /app/certificates/localhost-key.pem ./certificates/
   COPY --from=build /app/certificates/localhost.pem ./certificates/
   # 添加以下两行
   COPY --from=build /app/certificates/localhost.pem /usr/local/share/ca-certificates/localhost.crt
   RUN update-ca-certificates
   
   EXPOSE 3000
   
   CMD ["npm", "run", "start:https"]
   

3. 额外检查：确认后端服务在Docker中确实以HTTPS模式启动，代码中正确读取/tls/目录下的证书文件。

内容的提问来源于stack exchange，提问作者Egon