使用azure-spring-boot-starter-keyvault-certificates时密钥库位置为Null的问题

我尝试使用azure-spring-boot-starter-keyvault-certificates Starter Jar，将Azure密钥库和信任库加载到Spring Boot应用中，已完成以下步骤：

• 创建包含推荐依赖的Spring Boot应用
• 创建新的密钥库并上传证书
• 创建应用并配置所有权限，绑定到访问策略

但启动应用时出现如下错误：

Caused by: org.springframework.boot.web.server.WebServerException: Could not load key store 'null'
at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSslKeyStore(SslConnectorCustomizer.java:154) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSsl(SslConnectorCustomizer.java:103) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.customize(SslConnectorCustomizer.java:61) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeSsl(TomcatServletWebServerFactory.java:366) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeConnector(TomcatServletWebServerFactory.java:343) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:203) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:184) ~[spring-boot-2.7.14.jar:2.7.14]
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:162) ~[spring-boot-2.7.14.jar:2.7.14]
... 8 common frames omitted                                                                 
Caused by: java.lang.IllegalArgumentException: Resource location must not be null
at org.springframework.util.Assert.notNull(Assert.java:201) ~[spring-core-5.3.29.jar:5.3.29]
at org.springframework.util.ResourceUtils.getURL(ResourceUtils.java:130) ~[spring-core-5.3.29.jar:5.3.29]
at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSslKeyStore(SslConnectorCustomizer.java:151) ~[spring-boot-2.7.14.jar:2.7.14]
... 15 common frames omitted

我的application.yml配置如下：

management:
  endpoints:
    web:
    exposure:
      include: health,info,prometheus
spring:
  application:
    name: AzureKV
server:
 port: 8443
 ssl:
  enabled: true
  key-alias: certName
  key-store-type: AzureKeyVault
  trust-store-type: AzureKeyVault

azure:
 keyvault:
    enabled: true
    uri: <uri>
    client-id: <client ID>
    client-key: <Secret>
    tenant-id: <tenant-ID>

排查方向指引 #

• 修正YAML配置缩进错误：你的management.endpoints.web.exposure存在缩进问题，exposure应该是web的子节点，错误的缩进会导致配置解析异常，甚至影响其他配置的读取逻辑。修正后：

management:
  endpoints:
    web:
      exposure:
        include: health,info,prometheus

• 确认证书别名准确性：server.ssl.key-alias配置的certName必须和Azure密钥库中证书的别名完全一致，注意区分大小写，可在Azure密钥库的证书列表中查看实际别名。

• 验证Azure Key Vault配置有效性：

  • 确保azure.keyvault.uri、client-id、client-key、tenant-id已替换为实际的Azure资源信息，没有<uri>这类占位符
  • 检查应用的访问策略是否包含证书权限：需要分配证书获取(Get)、证书列出(List)权限，避免仅配置密钥/机密权限

• 检查依赖版本兼容性：当前使用Spring Boot 2.7.14，需确认azure-spring-boot-starter-keyvault-certificates的版本与Spring Boot兼容，建议使用匹配的版本（如Spring Boot 2.7.x对应Azure Starter 3.10.x系列）

• 简化SSL配置项：暂时移除无关的SSL配置，保留必要项，避免配置冲突：

server:
  port: 8443
  ssl:
    enabled: true
    key-alias: <实际证书别名>
    key-store-type: AzureKeyVault
    trust-store-type: AzureKeyVault

• 启用调试日志排查：添加日志配置，查看Azure Key Vault Starter的加载细节，确认是否成功连接并获取证书：

logging:
  level:
    com.azure.spring: DEBUG
    org.springframework.boot.web.embedded.tomcat: DEBUG

内容的提问来源于stack exchange，提问作者Aravind R