Adding RootCA (internal) to Keystore for Outgoing TLS

Configuring the server
1

Keycloak is running in docker. I’ve gone into the container and added my RootCA and my ADFS cert to the java keystore, that was mounted in a docker volume. I’m a little confused on how to get keycloak to trust my ADFS cert.

docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -v keycloak:/opt/keycloak/data/h2 -v kc_certs:/opt/keycloak/conf/ -v kc_truststore:/opt/truststore -e KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/keycloak.pem -e KC_HOSTNAME=keycloak.lab.local -e KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/keycloak.key -e KC_TLS_HOSTNAME_VERIFIER=ANY -e KC_TRUSTSTORE_PATH=/opt/truststore/ quay.io/keycloak/keycloak:latest start-dev --http-relative-path /auth

No matter what I do when I try to hit the ADFS URL for the saml entity descriptor, I get this:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

2

The env var is KC_TRUSTSTORE_PATHS not KC_TRUSTSTORE_PATH, so, an S is missing.

And further, from the docs:

List of pkcs12 (p12 or pfx file extensions), PEM files, or directories containing those files that will be used as a system truststore.

So you have to specify not only a directory, but a list of paths to all cert files which should be considered for the truststore.

1 Like