Docker Compose部署下Keycloak 16.1.1与Spring Boot的HTTPS通信问题

项目采用Spring Boot作为后端、Angular作为前端，使用Keycloak实现认证与安全，目前处于生产阶段。已购买SSL证书并部署到项目中，通过Docker Compose在Azure虚拟机上部署，所有容器（前端、后端、Keycloak、数据库）均正常运行，浏览器显示锁标识（SSL证书配置正确）。但前端无法调用后端API，查看后端日志发现报错：

2023-03-21 12:32:21 WARN  KeycloakDeployment:201 - Failed to load URLs from https://mydomain:8443/auth/realms/my-realm/.well-known/openid-configuration java.net.ConnectException: Connection timed out (Connection timed out)

推测问题出在后端与Keycloak的通信环节，此前未配置SSL时运行正常。已尝试以下操作但未解决问题：

• 在后端Dockerfile中导入证书到Java信任库
• 配置Keycloak的密钥库与信任库
• 在后端配置文件中添加SSL相关参数

Docker Compose配置片段 #

.
.
.
  backend:
    image: "backend:v0"
    container_name: "backend"
    build:
      context: backend
      dockerfile: ./Dockerfile
    ports:
      - "8180:443"
    environment:
      SPRING_DATASOURCE_URL:jdbc:mysql://projectmysqldb:3306/project_db?serverTimezone=UTC&createDatabaseIfNotExist=true
    depends_on:
       - bd
    networks:
       - mysql_backend_net
    restart: always


  frontend:
    image: "frontend:v0"
    container_name: "frontend"
    build:
      context: frontend
      dockerfile: ./Dockerfile
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - backend
    restart: always

        
  keycloak:
    image: "jboss/keycloak:16.1.1"
    container_name: keycloak
    environment:
      DB_VENDOR: H2
      DB_DATABASE: App
      DB_USER: root
      DB_PASSWORD: root
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: ********
      KEYCLOAK_TLS_TRUSTSTORE_FILE: /etc/x509/https/mydomain.jks
      KEYCLOAK_TLS_KEYSTORE_FILE: /etc/x509/https/mydomain.jks
      KEYCLOAK_TLS_TRUSTSTORE_PASSWORD: *****
      KEYCLOAK_TLS_KEYSTORE_PASSWORD: *****
    volumes:
      - ./certs/crt.pem:/etc/x509/https/tls.crt
      - ./certs/key.pem:/etc/x509/https/tls.key
      - ./certs/mydomain.jks:/etc/x509/https/mydomain.jks
    ports:
      - "8080:8080"
      - "8443:8443"
    networks:
      - mysql_backend_net
    depends_on:
      - bdd
    restart: always

后端application.properties配置片段 #

####### general config
server.port=443
server.servlet.context-path=/api

####### keycloak server config -- ok
keycloak.auth-server-url=https://mydomain:8443/auth/
keycloak.realm=my-realm
keycloak.resource=my-app
keycloak.bearer-only=true
keycloak.cors=true
keycloak.principal-attribute=preferred_username
frontClientSecret=*********
## admin we'll be creating for config (on Keycloak) -- not the super admin of kc
adminUsername=admin
adminSecret=*****

######## SSL config
security.require-ssl=true
server.ssl.key-store-type=PKCS12
server.ssl.key-store-password=******
server.ssl.key-store=/app/mydomain.p12
server.ssl.key-store-type=PKCS12
server.ssl.enabled=true

keycloak.client-keystore=/app/mydomain.jks
keycloak.client-keystore-password=*****
keycloak.truststore=/app/mydomain.p12
keycloak.truststore-password=******
keycloak.ssl-required=external

后端Dockerfile配置片段 #

# Use an OpenJDK Runtime as a parent image
FROM openjdk:11

# Set the working directory to /app
WORKDIR /app

# Copy the executable into the container at /app
ADD *.jar app.jar
COPY application.properties /app/

COPY mydomain.p12 /app/mydomain.p12
COPY mydomain.jks /app/mydomain.jks
COPY mydomain.crt /app/mydomain.crt
COPY entrypoint.sh entrypoint.sh

# Run app.jar when the container launches
RUN keytool -importcert -file /app/mydomain.crt -noprompt -alias mydomain -storepass changeit -keystore $JAVA_HOME/lib/security/cacerts
CMD ["java", "-jar", "/app/app.jar", "--spring.config.location=/app/application.properties"]

内容的提问来源于stack exchange，提问作者firdaouss lotfi