无法通过Ingress Nginx控制器进行SSL穿透

Question

我有一个Java Spring Boot应用程序，并且我已经配置了服务器以在SSL上运行，并且这是强制性的。

server:
  port: 8443
  ssl:
    enabled: true
    key-store-type: pkcs12
    key-store: ${KEYSTORE}
    key-password: ${KEYSTORE_PASSWORD}
    key-store-password: ${KEYSTORE_PASSWORD}
    client-auth: need

我已经使用Let's Encrypt证书为我的域名*.kahootali.com创建了一个证书，并通过运行命令创建了一个p12文件作为密钥库。

openssl pkcs12 -export -CAfile ca.crt -in cert.pem -inkey key.pem -certfile cert.pem -out kstore.p12

我想使用Ingress Nginx Controller在Kubernetes上公开它，因此我已经创建了一个秘密。

kubectl create secret generic store --from-file=kstore.p12

我已部署应用程序，可以看到部署文件，当我将本地的 8443 端口转发到其服务的 8443 端口并运行时。

curl -iv --cacert ca.crt --cert mediator_cert.pem --key mediator_key.pem --resolve 'spring-app.kahootali.com:8443:127.0.0.1' https://spring-app.kahootali.com:8443/

它运行正常并返回

* Added spring-app.kahootali.com:8444:127.0.0.1 to DNS cache
* Hostname spring-app.kahootali.com was found in DNS cache
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to spring-app.kahootali.com (127.0.0.1) port 8444 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: ca.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.kahootali.com
*  start date: Feb 11 10:27:47 2021 GMT
*  expire date: May 12 10:27:47 2021 GMT
*  subjectAltName: host "spring-app.kahootali.com" matched cert's "*.kahootali.com"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
> GET / HTTP/1.1
> Host: spring-app.kahootali.com:8444
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 404 
HTTP/1.1 404 
< X-Application-Context: application:8443
X-Application-Context: application:8443
< Content-Type: application/json;charset=UTF-8
Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
Transfer-Encoding: chunked
< Date: Sun, 14 Feb 2021 14:29:47 GMT
Date: Sun, 14 Feb 2021 14:29:47 GMT

< 
* Connection #0 to host spring-app.kahootali.com left intact
{"timestamp":1613312987350,"status":404,"error":"Not Found","message":"No message available","path":"/"}

但是当我为它创建一个Ingress并进行ssl-passthrough时

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: spring-monitoring-app
  labels:
    app: spring-monitoring-app
  annotations:
    ingress.kubernetes.io/force-ssl-redirect: "true"
    ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
  rules:
    - host: spring-app.kahootali.com
      http:
        paths:
          - path: /
            backend:
              serviceName: spring-monitoring-app
              servicePort: http
  tls:
    - hosts:
      - spring-app.kahootali.com
      secretName: tls-cert

在浏览器中会显示ERR_BAD_SSL_CLIENT_AUTH_CERT，在应用程序的Debug级别日志中则会显示。

Error during SSL handshake
java.io.IOException: EOF during handshake.
The SNI host name extracted for this connection was [spring-app.kahootali.com]
Handshake failed during wrap
javax.net.ssl.SSLHandshakeException: Empty server certificate chain

- Ali Kahoot

---

根据文档，SSL透传功能默认是禁用的。要启用它，您需要在启动nginx-ingress控制器时加上--enable-ssl-passthrough标志。确保您没有忘记这一点。 - mario

Answer 1

我会将其翻译为中文：

我将我的评论发布为答案，以便更好地展示：

根据 文档，SSL穿透 功能默认是禁用的。为了启用它，您需要使用 --enable-ssl-passthrough 标志启动您的 nginx-ingress 控制器。请确保您没有忘记它。

您还可以查看这些 故障排除步骤 来验证您的nginx-ingress 控制器 配置。

如果有帮助，请告诉我。

- mario