# TLS / SSL configuration within Kubernetes cluster **URL:** \ **Category:** Configuring the server\ **Created:** [December 2, 2020, 9:38pm UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245 "2020-12-02T21:38:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![haeussler247](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/haeussler247/32/1204_2.png) [@haeussler247](https://forum.keycloak.org/u/haeussler247)\ **Post date:** [December 2, 2020, 9:38pm UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/1 "2020-12-02T21:38:39Z")
Hi together, I’m getting following error as soon as I try to request a resource from keycloak via spring boot. `Failed to load URLs from https://keycloak.myDomain/auth/realms/myRealm/.well-known/openid-configuration` `javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target` I’m running Keycloak within a Kubernetes cluster which is managed by rancher. I’m using the codecentric helm chart to deploy Keycloak. This error, which I mentioned above, is not happening, as soon as I use `keycloak.disable-trust-manager=true` in my spring application.properties file. That lead me to believe it is a issue with tls /ssl. Here is my keycloak helm chart values: ``` tls: - hosts: - keycloak.myDomain secretName: "k8s-secret" ``` Here is my spring boot applications.properties file: ``` keycloak.auth-server-url=https://keycloak.myDomain/auth keycloak.ssl-required=external ``` I provide a certificate via the cert-manager within rancher for my `keycloak.myDomain`, to make sure this domain has https. I read a lot of things about the Truststore to enable ssl for keycloak. My question is now, didn’t I do this already when I added the tls section to my values.yaml? Or the other question would be, why is the cert which I created from my cert-manager not working? Thanks for your explanations. Best Regards Johannes ---
**Author:** ![belfhi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/belfhi/32/1690_2.png) [@belfhi](https://forum.keycloak.org/u/belfhi)\ **Post date:** [December 11, 2020, 9:26am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/2 "2020-12-11T09:26:29Z")
Hello, maybe it is just a formatting issue, but `secretName` should be in the same column as `hosts`. Is there a certificate under “Secrets” in Rancher that was created from cert-manager for your domain? cheers ---
**Author:** ![haeussler247](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/haeussler247/32/1204_2.png) [@haeussler247](https://forum.keycloak.org/u/haeussler247)\ **Post date:** [December 11, 2020, 11:24am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/3 "2020-12-11T11:24:12Z")
Hi, yes this is just a formatting issue in this thread here, in my setup it’s correct. I checked the certificate, and I have a certificate for `keycloak.domain.de`. This error messages appears, when I have my spring backend running locally. And this local spring backend tries to connect with the server keycloak. Since the error messages states: `unable to find valid certification path to requested target`, does target mean my local setup? Best Regards ---
**Author:** ![haeussler247](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/haeussler247/32/1204_2.png) [@haeussler247](https://forum.keycloak.org/u/haeussler247)\ **Post date:** [December 29, 2020, 11:07am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/4 "2020-12-29T11:07:10Z")
Does anyone have any more tips? ---
**Author:** ![martinleim](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/martinleim/32/1766_2.png) [@martinleim](https://forum.keycloak.org/u/martinleim)\ **Post date:** [December 29, 2020, 11:17am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/5 "2020-12-29T11:17:50Z")
> [@haeussler247](#): > > unable to find valid certification path to requested target In my experience, this message merely means that _something_ is wrong with the certificate validation, it does not tell you what. Try to enable [SSL debugging](https://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/ReadDebug.html) to help you pinpointing the source of the problem. ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [December 29, 2020, 2:15pm UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/6 "2020-12-29T14:15:56Z")
> [@haeussler247](#): > > unable to find valid certification path to requested target Very likely intermediate certificate(s) haven’t been added to the cert. Quite regular issue for beginners with Let’s Encrypt certs. Try to test that `https://keycloak.myDomain` with [SSL Server Test (Powered by Qualys SSL Labs)](https://www.ssllabs.com/ssltest/) ---
**Author:** ![haeussler247](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/haeussler247/32/1204_2.png) [@haeussler247](https://forum.keycloak.org/u/haeussler247)\ **Post date:** [December 30, 2020, 7:49am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/7 "2020-12-30T07:49:44Z")
Wow, thank you very much 🙂 With this debugging enabled, I’m seeing an error message 🙂 ``` %% Invalidated: [Session-19, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256] https-jsse-nio-8443-exec-5, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown ``` That looks like the issue I’m having. But I’m not quite sure how this can happen. @jangaraj when I use the SSL Lab test I get a rating of A+, that looks fine to me. ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [December 30, 2020, 9:23am UTC](https://forum.keycloak.org/t/tls-ssl-configuration-within-kubernetes-cluster/6245/8 "2020-12-30T09:23:47Z")
Then it looks like you don’t have a valid CA certificates available on your Java level. Make sure you have current CA certs installed (or managed but Rancher if it is possible).