# Truststore in KC 17 Quarkus for LDAPS/TLS

**URL:** <https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416>\
**Category:** Configuring the server\
**Created:** [March 18, 2022, 2:07pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416 "2022-03-18T14:07:12Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefan1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@stefan1](https://forum.keycloak.org/u/stefan1)\
**Post date:** [March 18, 2022, 2:07pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/1 "2022-03-18T14:07:12Z")

</div>

Hi,  
I’m having trouble to find the option for configuring a truststore. In the Advanced Settings of LDAP there is a tooltip that points to a file named standalone.xml/domain.xml, but this only seems to exist in the WildFly-distribution and not in the Quarkus one we use.

 ![Bildschirmfoto 2022-03-18 um 15.00.33](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/5/5547a8379c808a5374ae6e6376e690fbe3e53623.png)

The goal is to import the certificate of the LDAP server to use LDAPS/TLS. If somebody could shed some light on this issue I really would appreciate.

Thank you,  
Stefan

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [March 18, 2022, 2:19pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/2 "2022-03-18T14:19:55Z")

</div>

You have to create the truststore file externally, copy it into the Keycloak image and configure it with these properties: [Keycloak - Server - All configuration](https://www.keycloak.org/server/all-config?q=trust-store)

---

<div class="post-metadata">

**Author:** ![stefan1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@stefan1](https://forum.keycloak.org/u/stefan1)\
**Post date:** [March 18, 2022, 3:14pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/3 "2022-03-18T15:14:04Z")

</div>

Yay thank you, worked!

---

<div class="post-metadata">

**Author:** ![breed](https://avatars.discourse-cdn.com/v4/letter/b/d6d6ee/32.png) [@breed](https://forum.keycloak.org/u/breed)\
**Post date:** [March 20, 2022, 7:15pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/4 "2022-03-20T19:15:16Z")

</div>

Hi @stefan1 @dasniko  
I have a same problem but not works for me.  
I define trust store and import cert in dockerfile.  
Don’t know where the mistake is?

ENV KC\_HTTPS\_TRUST\_STORE\_FILE=conf/ldap-test.jks  
ENV KC\_HTTPS\_TRUST\_STORE\_PASSWORD=PW1  
RUN keytool -import -noprompt -trustcacerts -storepass PW1 -alias ldap-test -file ldap-test.cer -keystore conf/ldap-test.jks

Thank you  
Breed

---

<div class="post-metadata">

**Author:** ![stefan1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@stefan1](https://forum.keycloak.org/u/stefan1)\
**Post date:** [March 21, 2022, 9:29am UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/5 "2022-03-21T09:29:29Z")

</div>

Sorry, I directly modified the conf/keycloak.conf, don’t know how it works with docker.

EDIT: doesn’t work for me either, I thought it worked at first glance, but it was only the LDAP-Connection-Test that worked. But when I try to authenticate I get this error - same as if i didn’t configure a truststore:

```auto
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

```

I added the following options to the conf/keycloak.conf:

```auto
https-trust-store-file=/opt/keycloak/truststore.jks
https-trust-store-password= ********************

```

and added the CA-Certificate of the LDAP-Server with this command:

```auto
keytool -importcert -v -trustcacerts -alias ucs-ca -file ucsCAcert.pem -keystore truststore.jks

```

I also tried to add the certificate of the LDAP-Server:

```auto
rm truststore.jks
keytool -import -alias dc.ourdomain.de -keystore truststore.jks -file dc.ourdomain.de.cer

```

– same error

---

<div class="post-metadata">

**Author:** ![stefan1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@stefan1](https://forum.keycloak.org/u/stefan1)\
**Post date:** [March 21, 2022, 12:56pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/6 "2022-03-21T12:56:36Z")

</div>

Ok it works with the default java keystore - for me on Ubuntu it was:

```auto
keytool -importcert -alias ucs-CA -keystore /usr/lib/jvm/default-java/lib/security/cacerts -file ucsCAcert.pem

```

[https://plone.lucidsolutions.co.nz/linux/java/how-to-add-a-certificate-authority-ca-certificate-to-the-openjdk-cacerts](https://plone.lucidsolutions.co.nz/linux/java/how-to-add-a-certificate-authority-ca-certificate-to-the-openjdk-cacerts)

Still wondering why it doesn’t work with a custom added truststore.

---

<div class="post-metadata">

**Author:** ![stefan1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@stefan1](https://forum.keycloak.org/u/stefan1)\
**Post date:** [March 21, 2022, 2:16pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/7 "2022-03-21T14:16:08Z")

</div>

@breed @dasniko

Found the right parameter:

> **[Configuring outgoing HTTP requests - Keycloak](https://www.keycloak.org/server/outgoinghttp#_outgoing_https_request_truststore)**
>
> Keycloak is an open source identity and access management solution

`--spi-truststore-file-file` and `--spi-truststore-file-password` were the parameters i was looking for

And here is described how to add host certificates to the truststore (dunno if it also works with CA-Certificates, but I think so):

[https://www.keycloak.org/docs/latest/server\_installation/index.html#\_truststore](https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore)

---

<div class="post-metadata">

**Author:** ![breed](https://avatars.discourse-cdn.com/v4/letter/b/d6d6ee/32.png) [@breed](https://forum.keycloak.org/u/breed)\
**Post date:** [March 22, 2022, 1:41pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/8 "2022-03-22T13:41:05Z")

</div>

@stefan1 thank you for your reply.

But not works for me still.

```auto
ENV KC_SPI_TRUSTSTORE_FILE_FILE=conf/ldap-test.jks
ENV KC_SPI_TRUSTSTORE_FILE_PASSWORD=PW

```

```auto
RUN keytool -importcert -alias ldaptest-CA -storepass PW -noprompt -file /opt/keycloak/ldap-test.cer -keystore conf/ldap-test.jks

```

---

<div class="post-metadata">

**Author:** ![breed](https://avatars.discourse-cdn.com/v4/letter/b/d6d6ee/32.png) [@breed](https://forum.keycloak.org/u/breed)\
**Post date:** [March 22, 2022, 8:26pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/9 "2022-03-22T20:26:27Z")

</div>

Similar problem with using

```auto
ENV KC_SPI_TRUSTSTORE_FILE_....

```

> <https://github.com/keycloak/keycloak/issues/10873>
>
> \### Describe the bug
> 
> After switching from KC16 to KC17, verification of the d…atabase certs are not working anymore. In KC16, we set the trust store and parameters for verification via ENVs:
> 
> \`\`\`
> JAVA\_OPTS='-Djavax.net.ssl.trustStore=/certs/truststore.jks -Djavax.net.ssl.trustStorePassword=\[PASSWORD\]'
> JDBC\_PARAMS: "verifyServerCertificate=true&useSSL=true&requireSSL=true&enabledTLSProtocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3"
> \`\`\`
> 
> In KC17, we set:
> 
> \`\`\`
> KC\_DB\_URL= "jdbc:mysql://\[AURORA\_MYSQL\_URL\]:3306/keycloak\_17\_0\_0?user=\[USERNAME\]&password=\[PASSWORD\]&verifyServerCertificate=true&useSSL=true&requireSSL=true&enabledTLSProtocols=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3&characterEncoding=UTF-8"
> KC\_SPI\_TRUSTSTORE\_FILE\_FILE= "/certs/truststore.jks"
> KC\_SPI\_TRUSTSTORE\_FILE\_PASSWORD="\[PASSWORD\]"
> \`\`\`
> 
> Changing the trust store path or password results in an error, hence, the trust store seems to be loaded correctly.
> 
> \### Version
> 
> 17.0.0
> 
> \### Expected behavior
> 
> Since the trust store has not changed at all, we expect that the certificate verification works in KC17, too. If we change the parameter \`verifyServerCertificate\` to \`False\` the error disappears.
> 
> \### Actual behavior
> 
> The following exception is thrown:
> 
> \`\`\`
> ...
> 2022-03-22 11:52:26,680 WARN \[io.agroal.pool\] (agroal-11) Datasource '\<default\>': Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> 2022-03-22 11:52:26,682 WARN \[org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator\] (JPA Startup Thread: keycloak-default) HHH000342: Could not obtain connection to query metadata: com.mysql.cj.jdbc.exceptions.CommunicationsException: Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> at com.mysql.cj.jdbc.exceptions.SQLError.createCommunicationsException(SQLError.java:174)
> at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:64)
> at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:829)
> at com.mysql.cj.jdbc.ConnectionImpl.\<init\>(ConnectionImpl.java:449)
> at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:242)
> at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:198)
> at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:416)
> at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:128)
> at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:113)
> at com.mysql.cj.jdbc.MysqlXADataSource.getXAConnection(MysqlXADataSource.java:52)
> at io.agroal.pool.ConnectionFactory.createConnection(ConnectionFactory.java:216)
> at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:513)
> at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:494)
> at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
> at io.agroal.pool.util.PriorityScheduledExecutor.beforeExecute(PriorityScheduledExecutor.java:75)
> at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1126)
> at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
> at java.base/java.lang.Thread.run(Thread.java:829)
> Caused by: com.mysql.cj.exceptions.CJCommunicationsException: Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
> at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
> at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
> at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:61)
> at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:105)
> at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:151)
> at com.mysql.cj.exceptions.ExceptionFactory.createCommunicationsException(ExceptionFactory.java:167)
> at com.mysql.cj.protocol.a.NativeProtocol.negotiateSSLConnection(NativeProtocol.java:317)
> at com.mysql.cj.protocol.a.NativeAuthenticationProvider.connect(NativeAuthenticationProvider.java:204)
> at com.mysql.cj.protocol.a.NativeProtocol.connect(NativeProtocol.java:1369)
> at com.mysql.cj.NativeSession.connect(NativeSession.java:133)
> at com.mysql.cj.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:949)
> at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:819)
> ... 15 more
> Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
> at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
> at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:352)
> at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:295)
> at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:290)
> at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
> at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
> at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
> at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
> at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
> at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
> at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
> at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
> at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1501)
> at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1411)
> at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:451)
> at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:422)
> at com.mysql.cj.protocol.ExportControlled.performTlsHandshake(ExportControlled.java:347)
> at com.mysql.cj.protocol.StandardSocketFactory.performTlsHandshake(StandardSocketFactory.java:194)
> at com.mysql.cj.protocol.a.NativeSocketConnection.performTlsHandshake(NativeSocketConnection.java:101)
> at com.mysql.cj.protocol.a.NativeProtocol.negotiateSSLConnection(NativeProtocol.java:308)
> ... 20 more
> Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
> at com.mysql.cj.protocol.ExportControlled$X509TrustManagerWrapper.checkServerTrusted(ExportControlled.java:408)
> at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1549)
> at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
> ... 35 more
> Caused by: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
> at java.base/sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:157)
> at java.base/sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:83)
> at java.base/java.security.cert.CertPathValidator.validate(CertPathValidator.java:309)
> at com.mysql.cj.protocol.ExportControlled$X509TrustManagerWrapper.checkServerTrusted(ExportControlled.java:402)
> ... 37 more
> 
> 2022-03-22 11:52:26,895 INFO \[org.infinispan.CONTAINER\] (keycloak-cache-init) ISPN000128: Infinispan version: Infinispan 'Triskaidekaphobia' 13.0.5.Final
> 2022-03-22 11:52:27,062 INFO \[org.infinispan.CLUSTER\] (keycloak-cache-init) ISPN000078: Starting JGroups channel \`ISPN\`
> 2022-03-22 11:52:27,069 INFO \[org.infinispan.CLUSTER\] (keycloak-cache-init) ISPN000088: Unable to use any JGroups configuration mechanisms provided in properties {}. Using default JGroups configuration!
> 2022-03-22 11:52:27,183 WARN \[org.jgroups.protocols.UDP\] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
> 2022-03-22 11:52:27,184 WARN \[org.jgroups.protocols.UDP\] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 20.00MB, but the OS only allocated 212.99KB
> 2022-03-22 11:52:27,184 WARN \[org.jgroups.protocols.UDP\] (keycloak-cache-init) JGRP000015: the send buffer of socket MulticastSocket was set to 1.00MB, but the OS only allocated 212.99KB
> 2022-03-22 11:52:27,185 WARN \[org.jgroups.protocols.UDP\] (keycloak-cache-init) JGRP000015: the receive buffer of socket MulticastSocket was set to 25.00MB, but the OS only allocated 212.99KB
> 2022-03-22 11:52:29,199 INFO \[org.jgroups.protocols.pbcast.GMS\] (keycloak-cache-init) keycloak-17-698bdc8c8b-sn5s2-48664: no members discovered after 2003 ms: creating cluster as coordinator
> 2022-03-22 11:52:29,209 INFO \[org.infinispan.CLUSTER\] (keycloak-cache-init) ISPN000094: Received new cluster view for channel ISPN: \[keycloak-17-698bdc8c8b-sn5s2-48664|0\] (1) \[keycloak-17-698bdc8c8b-sn5s2-48664\]
> 2022-03-22 11:52:29,213 INFO \[org.infinispan.CLUSTER\] (keycloak-cache-init) ISPN000079: Channel \`ISPN\` local address is \`keycloak-17-698bdc8c8b-sn5s2-48664\`, physical addresses are \`\[192.168.150.92:44031\]\`
> 2022-03-22 11:52:29,825 INFO \[org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory\] (main) Node name: keycloak-17-698bdc8c8b-sn5s2-48664, Site name: null
> 2022-03-22 11:52:29,910 WARN \[io.agroal.pool\] (agroal-11) Datasource '\<default\>': Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> 2022-03-22 11:52:29,929 INFO \[org.infinispan.CLUSTER\] (main) ISPN000080: Disconnecting JGroups channel \`ISPN\`
> 2022-03-22 11:52:29,973 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Failed to start server in (production) mode
> 2022-03-22 11:52:29,973 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Failed to obtain JDBC connection
> 2022-03-22 11:52:29,973 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> 2022-03-22 11:52:29,974 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Communications link failure
> 
> The last packet sent successfully to the server was 0 milliseconds ago. The driver has not received any packets from the server.
> 2022-03-22 11:52:29,974 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
> 2022-03-22 11:52:29,974 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
> 2022-03-22 11:52:29,975 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) ERROR: Path does not chain with any of the trust anchors
> 2022-03-22 11:52:29,975 ERROR \[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler\] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.
> \`\`\`
> 
> \### How to Reproduce?
> 
> \_No response\_
> 
> \### Anything else?
> 
> The keystore contains the \[aws rds root certificate\](https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem) and the \[Starfield Services Root Certificate Authority\](https://www.amazontrust.com/repository/), both added (in that order) via:
> 
> \`\`\`
> keytool -import -alias mysqlServerCACert -file rds-ca-2019-root.pem -keystore truststore.jks
> keytool -import -alias aws\_root\_starfield -file aws\_root\_starfield.pem -keystore truststore.jks
> \`\`\`

---

<div class="post-metadata">

**Author:** ![sat2008](https://avatars.discourse-cdn.com/v4/letter/s/3ab097/32.png) [@sat2008](https://forum.keycloak.org/u/sat2008)\
**Post date:** [January 20, 2023, 9:58pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/10 "2023-01-20T21:58:47Z")

</div>

Hello Dasniko , I am new to Keycloak and we are currently configuring the keycloak Quarkus version running on a Linux and I am not able to figure out how to get my windows AD cert into keycloak for LDAPS . I can not find any detail information for this setup.  
I noticed over 2K people viewed this topic it would be a great help 😀  
Is there a step by step documentation for how to Create truststore file and where to save into Keycloak ? Where to add the server certificate ? Thanks

---

<div class="post-metadata">

**Author:** ![lajibolala](https://avatars.discourse-cdn.com/v4/letter/l/a4c791/32.png) [@lajibolala](https://forum.keycloak.org/u/lajibolala)\
**Post date:** [April 26, 2023, 7:28pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/12 "2023-04-26T19:28:00Z")

</div>

Hi, Can you help me on this [question](http://forum.keycloak.org/t/javax-net-ssl-sslhandshakeexception-when-connecting-keycloak-to-ldap-over-ssl/21721)

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [April 26, 2023, 7:34pm UTC](https://forum.keycloak.org/t/truststore-in-kc-17-quarkus-for-ldaps-tls/14416/13 "2023-04-26T19:34:44Z")

</div>

RTD: [Configuring trusted certificates for outgoing requests - Keycloak](https://www.keycloak.org/server/keycloak-truststore)