# Unable to send backchannel logout notification to opensearch

**URL:** <https://forum.keycloak.org/t/unable-to-send-backchannel-logout-notification-to-opensearch/25896>\
**Category:** Configuring the server\
**Tags:** authentication, oidc\
**Created:** [May 7, 2024, 11:04am UTC](https://forum.keycloak.org/t/unable-to-send-backchannel-logout-notification-to-opensearch/25896 "2024-05-07T11:04:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jayashree-Rajendran](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jayashree-rajendran/32/9888_2.png) [@Jayashree-Rajendran](https://forum.keycloak.org/u/Jayashree-Rajendran)\
**Post date:** [May 7, 2024, 11:04am UTC](https://forum.keycloak.org/t/unable-to-send-backchannel-logout-notification-to-opensearch/25896/1 "2024-05-07T11:04:26Z")

</div>

Keycloak unable to send back channel logout notification to opensearch. I am below error in keycloak

2024-04-23 11:06:46,084 WARN [org.keycloak.services] (executor-thread-8) KC-SERVICES0057: Logout for client ‘opensearch-1’ failed: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)  
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)  
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)  
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)  
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)  
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)  
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)  
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)  
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)  
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:458)  
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:201)  
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)  
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)  
at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)  
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)  
at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)  
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)  
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)  
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)  
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)  
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)  
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)  
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)  
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)  
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)  
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)  
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)  
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)  
at org.keycloak.services.managers.ResourceAdminManager.sendBackChannelLogoutRequestToClientUri(ResourceAdminManager.java:220)  
at org.keycloak.services.managers.ResourceAdminManager.logoutClientSessionWithBackchannelLogoutUrl(ResourceAdminManager.java:185)  
at org.keycloak.protocol.oidc.OIDCLoginProtocol.backchannelLogout(OIDCLoginProtocol.java:362)  
at org.keycloak.services.managers.AuthenticationManager.backchannelLogoutClientSession(AuthenticationManager.java:518)  
at org.keycloak.services.managers.AuthenticationManager.backchannelLogoutAll(AuthenticationManager.java:402)  
at org.keycloak.services.managers.AuthenticationManager.backchannelLogout(AuthenticationManager.java:305)  
at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:733)  
at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logoutToken(LogoutEndpoint.java:541)  
at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint.logout(LogoutEndpoint.java:339)  
at org.keycloak.protocol.oidc.endpoints.LogoutEndpoint$quarkusrestinvoker$logout\_ec1b9c1172e58a61f0cda37bd026fe76abe736a1.invoke(Unknown Source)  
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)  
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)  
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)  
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)  
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)  
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)  
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)  
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)  
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)  
at java.base/java.lang.Thread.run(Thread.java:840)  
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)  
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)  
at java.base/sun.security.validator.Validator.validate(Validator.java:264)  
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)  
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)  
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1341)  
… 43 more  
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target  
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)  
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)  
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)  
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)  
… 48 more

Can someone help in fixing this issue? How do i configure opensearch ccertificate in keycloak?

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [May 7, 2024, 1:40pm UTC](https://forum.keycloak.org/t/unable-to-send-backchannel-logout-notification-to-opensearch/25896/2 "2024-05-07T13:40:43Z")

</div>

How hard can it be to loot that up in the guides?

> **[Configuring trusted certificates - Keycloak](https://www.keycloak.org/server/keycloak-truststore)**
>
> Keycloak is an open source identity and access management solution