# Tutorial: Keycloak 16 and SSL Configuration

**URL:** <https://forum.keycloak.org/t/tutorial-keycloak-16-and-ssl-configuration/12776>\
**Category:** Tips and tricks\
**Created:** [December 24, 2021, 2:16pm UTC](https://forum.keycloak.org/t/tutorial-keycloak-16-and-ssl-configuration/12776 "2021-12-24T14:16:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![soundsessential](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@soundsessential](https://forum.keycloak.org/u/soundsessential)\
**Post date:** [December 24, 2021, 2:16pm UTC](https://forum.keycloak.org/t/tutorial-keycloak-16-and-ssl-configuration/12776/1 "2021-12-24T14:16:28Z")

</div>

As an addition to our Setting Up A Keycloak Server For Authenticating To FileMaker series, we’ve documented the new approach to configuring the SSL certificate in Keycloak 16. Hopefully this is useful to more than just FileMaker folks:

> **[Setting Up A Keycloak Server For Authenticating To FileMaker: Part 10:...](https://soundsessential.medium.com/setting-up-a-keycloak-server-for-authenticating-to-filemaker-part-10-keycloak-16-ssl-82b636f49194)**
>
> Lesson in Brief: Changes In Keycloak 16 Require A Different SSL Configuration Set Up

It is also available on our website at [soundsessential.com](http://soundsessential.com).

---

<div class="post-metadata">

**Author:** ![rmoqpd5t](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rmoqpd5t/32/2208_2.png) [@rmoqpd5t](https://forum.keycloak.org/u/rmoqpd5t)\
**Post date:** [January 6, 2022, 3:01pm UTC](https://forum.keycloak.org/t/tutorial-keycloak-16-and-ssl-configuration/12776/2 "2022-01-06T15:01:42Z")

</div>

Thank-you for the informative article. It seems to be based on the assumption that the keystore contains a single entry. Sites with multiple entries in their keystore should use the ‘alias-filter’ attribute as shown below:

```
        <tls>
            <key-stores>
                <key-store name="applicationKS">
                    <credential-reference clear-text="PASSWORD"/>
                    <implementation type="JKS"/>
                    <file path="keycloak.jks" relative-to="jboss.server.config.dir"/>
                </key-store>
            </key-stores>
            <key-managers>
                    <key-manager name="applicationKM" key-store="applicationKS" alias-filter="ALIAS" >
                    <credential-reference clear-text="PASSWORD"/>
                </key-manager>
            </key-managers>
            <server-ssl-contexts>
                <server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
            </server-ssl-contexts>
        </tls>

```

Where 'ALIAS" matches the output of keytool -list -keystore keycloak.jks and ‘PASSWORD’ matches the password of the keystore.

This attribute is described here: [Chapter&nbsp;1.&nbsp;Securing the Server and Its Interfaces Red Hat JBoss Enterprise Application Platform 7.2 | Red Hat Customer Portal](https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html/how_to_configure_server_security/securing_the_server_and_its_interfaces#using_filtering_key_store)