场景：项目使用了开源的kkfileview进行文件在线预览，部署方式使用的是docker，使用IP进行访问，但是http协议直接访问有漏洞告警，现在需要调整为https，且仍然需要使用IP访问。
kkfileview官网kkFileView - 在线文件预览
问题：使用自签证书将web中间件访问方式调整为https，代理kkfile容器8012端口，后预览图片正常，预览其他类型文件提示如下错误
错误信息：
下载失败:org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://192.168.1.1:80/api/admin/image/local/c639a28c6e4b4278b8c93ff94352957a.txt": sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
解决方法：
1.重新自包含签证书SAN(Subject Alternative Name)的证书
openssl genrsa -out server.key 2048 cat >server.cnf<<EOF [req] default_bits = 2048 prompt = no default_md = sha256 distinguished_name = dn req_extensions = req_ext [dn] C = CN ST = Province L = City O = Organization OU = Organizational Unit CN = test [req_ext] subjectAltName = @alt_names [alt_names] # 如果需要，可以添加更多的DNS或IP地址 #DNS.1 = baidu.com IP.1 = 192.168.1.1 IP.2 = 192.168.1.2 EOF openssl req -new -sha256 -key server.key -config server.cnf -out server.csr openssl x509 -req -days 3650 -in server.csr -signkey server.key -extfile server.cnf -extensions req_ext -out server.crt
2.修改Dockerfile把证书加入到kkfile的jdk环境
cat >Dockerfile<<EOF FROM keking/kkfileview:v4.4.0 MAINTAINER hello ADD server.crt /opt/ RUN keytool -import -alias myServer -file /opt/server.crt -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit -noprompt ENTRYPOINT ["java","-Dfile.encoding=UTF-8","-Dspring.config.location=/opt/kkFileView-4.4.0-beta/config/application.properties","-jar","/opt/kkFileView-4.4.0-beta/bin/kkFileView-4.4.0-beta.jar"] EOF docker build -t keking/kkfileview:v4.4.1 .
3.使用新镜像重新启动kkfileview
docker stop kkfile && docker rm kkfile docker run -d -p 8012:8012 -e KK_BASE_URL="https://192.168.1.1" --name kkfile keking/kkfileview:v4.4.1
4.替换web中间件的自签证书，重新加载web服务,验证预览
