Docker中修改OpenJDK 17 TLS禁用算法

最新推荐文章于 2025-07-07 20:19:16 发布

菲力蒲LY

最新推荐文章于 2025-07-07 20:19:16 发布

阅读量448

点赞数 5

CC 4.0 BY-SA版权

文章标签： docker java 容器

本文链接：https://blog.youkuaiyun.com/wangqingbo0829/article/details/147526359

问题：jdk17 发送邮件报错

报错内容：

ERROR c.b.c.exception.BDExceptionHandler - javax.mail.MessagingException: Could not connect to SMTP host: smtp.163.com, port: 465;
nested exception is:
javax.net.ssl.SSLException: Received fatal alert: internal_error
org.dromara.email.comm.errors.MailException: javax.mail.MessagingException: Could not connect to SMTP host: smtp.163.com, port: 465;
nested exception is:
javax.net.ssl.SSLException: Received fatal alert: internal_error
at org.dromara.email.core.service.MailService.ReSendList(MailService.java:177)
at org.dromara.email.core.service.MailService.send(MailService.java:122)
at org.dromara.email.core.service.MailService.send(MailService.java:63)

查询资料，分析原因：

JDK17默认禁用TLSv1.2及以下协议，而163的SMTP服务器可能仅支持TLSv1.2。

docker 当前配置：

docker 内 openjdk:17-jdk-alpine 修改 jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \ DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

"PATH=/opt/openjdk-17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "JAVA_HOME=/opt/openjdk-17", "JAVA_VERSION=17-ea+14", "TZ=Asia/Shanghai"

目标：

删除前：

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
   DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

删除后:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
  DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

方法：在 dockerfile 中添加以下内容

dockerfile

RUN sed -i.bak '/^jdk\.tls\.disabledAlgorithms=/ s/, TLSv1, TLSv1.1//' \
"${JAVA_HOME}/conf/security/java.security" \
    && rm "${JAVA_HOME}/conf/security/java.security.bak"

完整示例：

dockerfile

FROM openjdk:17-jdk-alpine

# 设置环境变量
ENV TZ=Asia/Shanghai \
    JAVA_HOME=/opt/openjdk-17 \
    PATH=/opt/openjdk-17/bin:$PATH

# 移除已禁用的TLSv1和TLSv1.1（假设它们已被默认禁用，需检查实际文件）
RUN sed -i.bak '/^jdk\.tls\.disabledAlgorithms=/ s/, TLSv1, TLSv1.1//' \
"${JAVA_HOME}/conf/security/java.security" \
    && rm "${JAVA_HOME}/conf/security/java.security.bak"

# 复制应用 JAR 包
COPY your-app.jar /app.jar

# 添加 TLSv1.2 协议参数并启动
CMD ["java", "-Dhttps.protocols=TLSv1.2", "-jar", "/app.jar"]

参考资料：

Deepseek