You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Encrypt certificates generated for SAML clients
#14030
Keycloak offers the ability to generate certificates for SAML clients in the Keys tab of the client settings. When pressing the Regenerate / Generate new keys button in the new / old interface, it will generate a private key and certificate pair that can be used by the client.
When the certificate is generated, it is either directly downloaded by the browser (in the new interface), or is displayed inside a text field (in the old interface). In both cases the private key is not encrypted, so it may be leaked when stored on the admin's system, or afterwards if it is not properly scrubbed from the disk.
I believe that adding password encryption for the key would be beneficial for the overall system security. This approach appears to be already implemented for JWKS keys for OIDC clients; it works with PKCS12 which can be converted to other formats such as PEM using various tools, such as openssl.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Keycloak offers the ability to generate certificates for SAML clients in the
Keystab of the client settings. When pressing theRegenerate/Generate new keysbutton in the new / old interface, it will generate a private key and certificate pair that can be used by the client.When the certificate is generated, it is either directly downloaded by the browser (in the new interface), or is displayed inside a text field (in the old interface). In both cases the private key is not encrypted, so it may be leaked when stored on the admin's system, or afterwards if it is not properly scrubbed from the disk.
I believe that adding password encryption for the key would be beneficial for the overall system security. This approach appears to be already implemented for JWKS keys for OIDC clients; it works with PKCS12 which can be converted to other formats such as PEM using various tools, such as openssl.
All reactions