AWS GovCloud 上 docker alpine wildfly 中的 NSS/PKCS11 错误

Posted 2023-02-27

【中文标题】AWS GovCloud 上 docker alpine wildfly 中的 NSS/PKCS11 错误

【英文标题】：NSS/PKCS11 errors in docker alpine wildfly on AWS GovCloud

【发布时间】：2020-02-05 20:46:40

【问题描述】：

我正在使用woahbase/alpine-wildfly 图像。在尝试连接到 S3 和/或 SQS 的 AWS 端点时，我不断收到以下错误： Caused by: java.security.ProviderException: Could not initialize NSS 和Caused by: java.io.IOException: NSS initialization failed。这些错误似乎类似于这个错误https://bugs.openjdk.java.net/browse/JDK-8023434，但这是针对 Windows 部署的。

这是完整的错误信息：

Exception in thread "main" java.lang.ExceptionInInitializerError
        at sun.security.ssl.SSLSessionImpl.<init>(SSLSessionImpl.java:188)
        at sun.security.ssl.SSLSessionImpl.<init>(SSLSessionImpl.java:152)
        at sun.security.ssl.SSLSessionImpl.<clinit>(SSLSessionImpl.java:79)
        at sun.security.ssl.SSLSocketImpl.init(SSLSocketImpl.java:598)
        at sun.security.ssl.SSLSocketImpl.<init>(SSLSocketImpl.java:566)
        at sun.security.ssl.SSLSocketFactoryImpl.createSocket(SSLSocketFactoryImpl.java:110)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:363)
        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.upgrade(DefaultHttpClientConnectionOperator.java:192)
        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.upgrade(PoolingHttpClientConnectionManager.java:369)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at com.amazonaws.http.conn.ClientConnectionManagerFactory$Handler.invoke(ClientConnectionManagerFactory.java:76)
        at com.amazonaws.http.conn.$Proxy2.upgrade(Unknown Source)
        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:415)
        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
        at com.amazonaws.http.apache.client.impl.SdkHttpClient.execute(SdkHttpClient.java:72)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1190)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
        at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
        at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
        at com.amazonaws.services.sqs.AmazonSQSClient.doInvoke(AmazonSQSClient.java:1740)
        at com.amazonaws.services.sqs.AmazonSQSClient.invoke(AmazonSQSClient.java:1716)
        at com.amazonaws.services.sqs.AmazonSQSClient.executeCreateQueue(AmazonSQSClient.java:718)
        at com.amazonaws.services.sqs.AmazonSQSClient.createQueue(AmazonSQSClient.java:695)
        at com.amazonaws.services.sqs.AmazonSQSClient.createQueue(AmazonSQSClient.java:730)
        at com.mycompany.ck.aws.credentials.test.Main.main(Main.java:54)
Caused by: java.security.ProviderException: Could not initialize NSS
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:223)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:103)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:224)
        at sun.security.jca.ProviderConfig$2.run(ProviderConfig.java:206)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:206)
        at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:187)
        at sun.security.jca.ProviderList.getProvider(ProviderList.java:233)
        at sun.security.jca.ProviderList.getIndex(ProviderList.java:263)
        at sun.security.jca.ProviderList.getProviderConfig(ProviderList.java:247)
        at sun.security.jca.ProviderList.getProvider(ProviderList.java:253)
        at java.security.Security.getProvider(Security.java:503)
        at sun.security.ssl.SignatureAndHashAlgorithm.<clinit>(SignatureAndHashAlgorithm.java:415)
        ... 36 more
Caused by: java.io.IOException: NSS initialization failed
        at sun.security.pkcs11.Secmod.initialize(Secmod.java:234)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:218)
        ... 52 more

我正在使用 docker 1.13.1 运行 RHEL 7.7 主机，构建 4ef4b30。 任何帮助，将不胜感激。谢谢！

【问题讨论】：

您找到解决方案了吗？ ，面临与亚马逊 s3 连接相同的问题，面临 pkcs11 异常将图像更改为 8u212-jre-alpine 仍然面临问题。对我来说，这是一个批处理作业。

【参考方案1】：

看起来该图像可能缺少与 SSL 算法一起使用的加密库。尝试安装openssl & nss 相关包

使用这些包构建一个自定义 dockerfile 并尝试执行它。

RUN apk add --no-cache nss openssl