# Keycloak 17 - encrypt traffic to database

**URL:** <https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201>\
**Category:** Configuring the server\
**Created:** [March 10, 2022, 2:10pm UTC](https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201 "2022-03-10T14:10:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrks](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mrks](https://forum.keycloak.org/u/mrks)\
**Post date:** [March 10, 2022, 2:10pm UTC](https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201/1 "2022-03-10T14:10:37Z")

</div>

Hi keycloak-users out there 🙂

I have been dealing with keycloak in version 15 and got it up running with a cluster.  
In this setup a secured database connection to a mariadb is configured.

Now, with keycloak 17 I want to switch to Quarkus. I cant find any options in the documentation [Keycloak - Server - Configuring the database](https://www.keycloak.org/server/db) to enable the encryption of the traffic to the database.

Is there any further documentation that would close my knowledge gab 😃 ?

Thanks in advanced  
mrks

---

<div class="post-metadata">

**Author:** ![ThoreKr](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thorekr/32/7713_2.png) [@ThoreKr](https://forum.keycloak.org/u/ThoreKr)\
**Post date:** [March 11, 2022, 4:10am UTC](https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201/2 "2022-03-11T04:10:00Z")

</div>

Since db-url expects a jdbc url you should be able to just use the according jdbc parameters, e.g., `jdbc:mariadb://127.0.0.1:3306/keycloak?verifyServerCertificate=false&useSSL=true&requireSSL=true`

---

<div class="post-metadata">

**Author:** ![mrks](https://avatars.discourse-cdn.com/v4/letter/m/e9bcb4/32.png) [@mrks](https://forum.keycloak.org/u/mrks)\
**Post date:** [March 11, 2022, 8:29am UTC](https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201/3 "2022-03-11T08:29:33Z")

</div>

Thx @ThoreKr for your reply.

Yeah, I did it that way in keycloak 15. I found some examples in the www, leading me to the correct syntax. So I inserted this connection string in the standalone-ha.xml. So I got a working mariadb cluster and the connection to keycloak 15 is encrypted.

But in keycloak 17 this file is gone. I only got this three files in the conf folder

```auto
keycloak-17.0.0/conf# ls -lah
total 20K
drwxr-xr-x 2 root root 4,0K Feb 18 12:03 .
drwxr-xr-x 7 root root 4,0K Feb 18 10:57 ..
-rw-rw-r-- 1 keycloak 1000 3,5K Feb 11 20:10 cache-ispn.xml
-rw-rw-r-- 1 keycloak 1000 1,1K Feb 11 07:00 keycloak.conf
-rw-rw-r-- 1 keycloak 1000 204 Feb 11 07:00 README.md

```

```auto
keycloak-17.0.0/conf# more README.md 
Configure the server
====================

Files in this directory are used to configure the server. Please consult the [configuration guides](https://www.keycloak.org/guides#server) for more information.

```

So here I am, and I read [Keycloak - Guides](https://www.keycloak.org/guides#server), but I still dont know, where to put this string. Feels, like I just read 50% of what I need to know. Due to the fact that keycloak 17 has a new config scheme, I cant even use google to search for infos. The web is full with deprecated stuff.  
Even my keycloak pdf, I bought to get more insights is now deprecated.

Do you have any advice/hint, how to start in keycloak 17. Please dont forget, that I just use keycloak 15 for about 2 month. All I need is a good and solid documentation, cause some questions will rise up after database configuration (e.g. clustering in non multicast network, etc.)

Thanks in advanced  
mrks

---

<div class="post-metadata">

**Author:** ![ThoreKr](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thorekr/32/7713_2.png) [@ThoreKr](https://forum.keycloak.org/u/ThoreKr)\
**Post date:** [March 11, 2022, 11:35am UTC](https://forum.keycloak.org/t/keycloak-17-encrypt-traffic-to-database/14201/4 "2022-03-11T11:35:32Z")

</div>

Managing config options in with quarkus basically gives you three options;

- Startup Parameter
- Environment Variables
- Config File

(I think in that priority, the first two might be swapped)

How to set it as startup parameter is shown in the guide you linked: [Keycloak - Server - Configuring the database](https://www.keycloak.org/server/db#_overriding_the_default_connection_settings)

Alternatively the sample keycloak.conf has these config keys already included (though commented out), you can just set them there.

All config properties can be set using these three ways [Keycloak - Server - All configuration](https://www.keycloak.org/server/all-config) also lists the corresponding environment variables. Be aware of the differentiation between build and runtime options (shown in the last column). In case of the database this only affects the `db` config key.

Edit: [Keycloak - Server - Configuring Keycloak](https://www.keycloak.org/server/configuration) the priority of the config sources seems correct.