# Run keycloak in Production without TLS configuration **URL:** \ **Category:** Configuring the server\ **Created:** [November 22, 2023, 5:33am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418 "2023-11-22T05:33:38Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 22, 2023, 5:33am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/1 "2023-11-22T05:33:38Z")
Hi All I am upgrading keycloak from version 15 to 21, while doing so i am facing one issue which is that to run keycloak 21 in production env it seems that it is essential to configure TLS, is there a way i can disable it.? because we are running keycloak in k8 cluster behind nginx. All the request to keycloak from public endpoint is routed via nginx for which we use https then nginx route those request to keycloak using http inside the cluster. For this reason it seems overhead for us to run keycloak with TLS enabled inside the cluster. Any suggestion or solution will be helpful. thanks ---
**Author:** ![sirishkumar](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sirishkumar/32/6459_2.png) [@sirishkumar](https://forum.keycloak.org/u/sirishkumar)\ **Post date:** [November 22, 2023, 6:57am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/2 "2023-11-22T06:57:18Z")
Below are the some of the configuration parameters(keycloak.conf) we set to enable http mode if TLS termination is done at load balancer. For reference [Configuring the hostname - Keycloak](https://www.keycloak.org/server/hostname) | option | value | description | | --- | --- | --- | | hostname-strict | false | Disables dynamically resolving the hostname from request headers | | hostname-strict-https | false | Required for running only in http mode | | http-enabled | true | Enables the HTTP listener | | proxy | edge | edge proxy mode enables communication through HTTP between the proxy and Keycloak | ---
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 24, 2023, 12:10pm UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/3 "2023-11-24T12:10:28Z")
thanks @sirishkumar , will try this. ---
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 27, 2023, 7:01am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/4 "2023-11-27T07:01:25Z")
> [@sirishkumar](#): > > true i am getting flowing error **ERROR ==\> You need to have TLS enabled. Please set the KEYCLOAK\_ENABLE\_HTTPS variable to true** This is my configurations KEYCLOAK\_PRODUCTION: “true” KEYCLOAK\_ENABLE\_HTTPS: “false” KC\_HOSTNAME\_STRICT: “false” KC\_HOSTNAME\_STRICT\_HTTPS: “false” KC\_HTTP\_ENABLED: “true” ---
**Author:** ![sirishkumar](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sirishkumar/32/6459_2.png) [@sirishkumar](https://forum.keycloak.org/u/sirishkumar)\ **Post date:** [November 27, 2023, 7:59am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/5 "2023-11-27T07:59:44Z")
> [@SSamyak](#): > > ERROR ==\> You need to have TLS enabled. Please set the KEYCLOAK\_ENABLE\_HTTPS Looks like you are using bitnami charts and as per this comment [bitnami/keycloak 8.0.\* / 9.0.\* Running Server in Development mode · Issue #10236 · bitnami/charts · GitHub](https://github.com/bitnami/charts/issues/10236#issuecomment-1412552357) , KEYCLOAK\_ENABLE\_HTTPS is required to be true if production mode(KEYCLOAK\_PRODUCTION) is set to True. This is something specific to bitnami chart and not to keycloak. I have no experience with the bitnami keycloak chart configuration. May be try setting KEYCLOAK\_PRODUCTION it to false and you need to analyze what are its implications with bitnami chart. ---
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 27, 2023, 8:46am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/6 "2023-11-27T08:46:45Z")
i found out one solution in the like you have shared, thanks. ---
**Author:** ![sirishkumar](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sirishkumar/32/6459_2.png) [@sirishkumar](https://forum.keycloak.org/u/sirishkumar)\ **Post date:** [November 27, 2023, 8:56am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/7 "2023-11-27T08:56:47Z")
It would be useful for others if you can post the exact solution which worked for you ---
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 27, 2023, 11:08am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/8 "2023-11-27T11:08:32Z")
Sure, By simple adding KEYCLOAK\_PROXY = edge i was able to resolve the issue This was helpful > > > \### Name and Version > > bitnami/keycloak 8.0.1 > > \### What steps will reproduce the …bug? > > 1. Deploy chart with version \`7.1.18\` > 2. Upgrade chart to version \`8.0.1\` > > \### Are you using any custom parameters or values? > > overrides in a seperate yaml > > \`\`\`yaml > pdb: > create: true > > autoscaling: > enabled: true > minReplicas: 2 > > cache: > ownersCount: 2 > authOwnersCount: 2 > > \# TLS is terminated by NGINX, NGINX -\> keycloak HTTP (wrapped in TLS by service-mesh) > \# ref: https://www.keycloak.org/server/reverseproxy > proxy: edge > > \# no longer a thing (was in older versions) > proxyAddressForwarding: true > replicaCount: 2 > > \# ServiceDiscovery, serviceAccount and rbac required when more than 1 replica exists > serviceDiscovery: > enabled: true > serviceAccount: > # required as KUBE\_PING is used as the discovery mechanism > automountServiceAccountToken: true > rbac: > create: true > rules: > - apiGroups: > - "" > resources: > - pods > verbs: > - get > - list > > service: > type: ClusterIP > > extraEnvVars: > # Without needing to force backend request through the frontend > # Need to look into /auth being removed in keycloak 17 > - name: KEYCLOAK\_EXTRA\_ARGS > value: "-Dkeycloak.frontendUrl=https://YOUR\_DOMAIN/auth" > \`\`\` > > \### What is the expected behavior? > > to not see a warning of "DO NOT use in production", this is pretty concerning. > > \### What do you see instead? > > 2022-05-16 10:42:47,041 WARN \[org.keycloak.quarkus.runtime.KeycloakMain\] (main) Running the server in development mode. DO NOT use this configuration in production. > > \### Additional information > > I'm having to read keycloak docs and marry them up with the chart, no docs around upgrades from the current chart version I am on, and the one I desire to be on exist so it is a bit of guess work, but I don't believe my override values cause this issue ---
**Author:** ![sirishkumar](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sirishkumar/32/6459_2.png) [@sirishkumar](https://forum.keycloak.org/u/sirishkumar)\ **Post date:** [November 28, 2023, 9:00am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/9 "2023-11-28T09:00:26Z")
Good to know, i also mentioned this in my first response 🙂 ---
**Author:** ![SSamyak](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ssamyak/32/9304_2.png) [@SSamyak](https://forum.keycloak.org/u/SSamyak)\ **Post date:** [November 28, 2023, 10:31am UTC](https://forum.keycloak.org/t/run-keycloak-in-production-without-tls-configuration/23418/11 "2023-11-28T10:31:04Z")
Yes , actually earlier i was using KC\_PROXY instead of KEYCLOAK\_PROXY. this seems to be causing the issue. This is the working configuration KEYCLOAK\_PRODUCTION: “true” KC\_HOSTNAME\_STRICT: “false” KC\_HOSTNAME\_STRICT\_HTTPS: “false” KEYCLOAK\_PROXY: “edge” KEYCLOAK\_ENABLE\_HTTPS: “false” PORT: 8080