当前位置：首页 > ds >正文

Docker中修改OpenJDK 17 TLS禁用算法

ds 2025/5/7 7:48:41

问题：jdk17 发送邮件报错

报错内容：

ERROR c.b.c.exception.BDExceptionHandler - javax.mail.MessagingException: Could not connect to SMTP host: smtp.163.com, port: 465;
nested exception is:
javax.net.ssl.SSLException: Received fatal alert: internal_error
org.dromara.email.comm.errors.MailException: javax.mail.MessagingException: Could not connect to SMTP host: smtp.163.com, port: 465;
nested exception is:
javax.net.ssl.SSLException: Received fatal alert: internal_error
at org.dromara.email.core.service.MailService.ReSendList(MailService.java:177)
at org.dromara.email.core.service.MailService.send(MailService.java:122)
at org.dromara.email.core.service.MailService.send(MailService.java:63)

查询资料，分析原因：

JDK17默认禁用TLSv1.2及以下协议，而163的SMTP服务器可能仅支持TLSv1.2。

docker 当前配置：

docker 内 openjdk:17-jdk-alpine 修改 jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \ DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

"PATH=/opt/openjdk-17/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", "JAVA_HOME=/opt/openjdk-17", "JAVA_VERSION=17-ea+14", "TZ=Asia/Shanghai"

目标：

删除前：

jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

删除后:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL

方法：在 dockerfile 中添加以下内容

dockerfile

RUN sed -i.bak '/^jdk\.tls\.disabledAlgorithms=/ s/, TLSv1, TLSv1.1//' \
"${JAVA_HOME}/conf/security/java.security" \&& rm "${JAVA_HOME}/conf/security/java.security.bak"

完整示例：

dockerfile

FROM openjdk:17-jdk-alpine# 设置环境变量
ENV TZ=Asia/Shanghai \JAVA_HOME=/opt/openjdk-17 \PATH=/opt/openjdk-17/bin:$PATH# 移除已禁用的TLSv1和TLSv1.1（假设它们已被默认禁用，需检查实际文件）
RUN sed -i.bak '/^jdk\.tls\.disabledAlgorithms=/ s/, TLSv1, TLSv1.1//' \
"${JAVA_HOME}/conf/security/java.security" \&& rm "${JAVA_HOME}/conf/security/java.security.bak"# 复制应用 JAR 包
COPY your-app.jar /app.jar# 添加 TLSv1.2 协议参数并启动
CMD ["java", "-Dhttps.protocols=TLSv1.2", "-jar", "/app.jar"]