构建Docker上的centos 8错误:加密(ssl/tls)握手失败

brjng4g3  于 2022-11-07  发布在  Docker
关注(0)|答案(1)|浏览(273)

我尝试从Visual Studio运行它代码可以找到本地数据库并连接到它。更改数据库设置环境变量运行Docker容器,但当我在Docker容器中运行应用程序时,无法连接到数据库运行容器,它返回此错误:

我尝试openssl构建tecmint.local.crt和tecmint.local.key将tecmint.local.crt文件复制到两个目录:

/usr/local/share/ca-certificates/extra

/etc/pki/ca-trust/source/anchors

Centos 8目录#

[root@localhost extra]# cd /etc/ssl/private
[root@localhost private]# ls
tecmint.local.crt  tecmint.local.key
[root@localhost extra]# cd /etc/pki/ca-trust/source/anchors
[root@localhost anchors]# ls
openssl-1.1.1k  openssl-1.1.1k.tar.gz  tecmint.local.crt
[root@localhost anchors]# cd /usr/local/share/ca-certificates/extra
[root@localhost extra]# ls
tecmint.local.crt

然后Docker运行dockerfile
并使用以下命令将证书装载到Docker容器上:

docker run -v /usr/local/share/ca-certificates/extra:/app/build -d 39bc3b53bb17 "update-ca-certificates"

停靠文件#

FROM mcr.microsoft.com/dotnet/aspnet:5.0-focal AS base
WORKDIR /app
EXPOSE 8000

ENV ASPNETCORE_ENVIRONMENT=Development
ENV ASPNETCORE_URLS=http://+:8000

RUN adduser -u 5678 --disabled-password --gecos "" appuser && chown -R appuser /app
USER appuser

FROM mcr.microsoft.com/dotnet/sdk:5.0-focal AS build
WORKDIR /src
COPY ["MVCVue.csproj", "./"]
RUN dotnet restore "MVCVue.csproj"
COPY . .
WORKDIR "/src/."
RUN dotnet build "MVCVue.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "MVCVue.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "MVCVue.dll"]

启动#

public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllersWithViews();
            services.AddDbContext<cpteContext>(options =>
            options.UseSqlServer(Configuration.GetConnectionString("BloggingDatabase")));

           services.AddAntiforgery(opiton => {
           opiton.FormFieldName = "MyAntiForgeryField";
           opiton.HeaderName = "ANTI-TOKEN-HEADERNAME";
});
        }

数据库上下文#

public partial class testContext : DbContext
    {
        public cpteContext(){}
        public cpteContext(DbContextOptions<cpteContext> options)  : base(options){}
        public virtual DbSet<Board> Boards { get; set; }
        public virtual DbSet<Operator> Operators { get; set; }

        protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
        {
            var configuration = new ConfigurationBuilder()
                            .SetBasePath(Directory.GetCurrentDirectory())
                            .AddJsonFile("appsettings.json")
                           .Build();
            if (!optionsBuilder.IsConfigured)
            {
                var connectionString = configuration.GetConnectionString("BloggingDatabase"); 
                optionsBuilder.UseSqlServer(connectionString);
            }

        }

应用程序设置.json#

"ConnectionStrings": {
    "BloggingDatabase": "Server=xxx.xxx.xxx.xxx;Database=testdb;Trusted_Connection=True;User Id=myid;Password=myPassword;Integrated Security=false;"
  },
deyfvvtc

deyfvvtc1#

在许多Linux发行版上,OpenSSL配置文件位于/etc/ssl/openssl. cnf。
代码加载项openssl.cnf

openssl_conf = default_conf

[ default_conf ]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=2

参考:https://learn.microsoft.com/zh-tw/dotnet/core/compatibility/cryptography/5.0/default-cipher-suites-for-tls-on-linux
复制到/usr/local/ssl/openssl.cnf中

请在Dockerfile中使用以下解决方法。

RUN sed -i 's/TLSv1.2/TLSv1.0/g' /etc/ssl/openssl.cnf

参考:https://github.com/microsoft/azuredatastudio/issues/11249
如果是目标服务器强制实施TLS加密时的服务器证书验证,则必须至少将此设置添加到连接字符串中(以强制使用SSL):

trustservercertificate=true

参考:https://github.com/dotnet/SqlClient/issues/633

相关问题