You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
PKIX client error with letsencrypt ssl cert on server and AdoptiumJDK 17 client
#20532
We have setup Keycloak 17.0.1 as a docker service with certificate files which we create with certbot from letsencrypt on the docker host and which are mounted into the container and passed with --https-certificate-file and --https-certificate-key-file to the start-dev command.
Accessing this keycloak instance from the browser works fine, the cert is accepted.
However, trying to access it from a Java 17 client (which out of the box does trust letsencrypt's ISRG Root X1) results in a PKIX error:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The only solution to that is to import our server's certificate into the JDK's cacerts keystore. This is however only a temporary solution and needs to be repeated every 3 months when the letsencrypt server certificate is renewed - which is a maintenance nightmare.
Does anyone have any idea why the browser trusts this cert but JDK doesn't (when it obviously trusts any other letsencrypt cert)?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
We have setup Keycloak 17.0.1 as a docker service with certificate files which we create with certbot from letsencrypt on the docker host and which are mounted into the container and passed with --https-certificate-file and --https-certificate-key-file to the start-dev command.
Accessing this keycloak instance from the browser works fine, the cert is accepted.
However, trying to access it from a Java 17 client (which out of the box does trust letsencrypt's ISRG Root X1) results in a PKIX error:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The only solution to that is to import our server's certificate into the JDK's cacerts keystore. This is however only a temporary solution and needs to be repeated every 3 months when the letsencrypt server certificate is renewed - which is a maintenance nightmare.
Does anyone have any idea why the browser trusts this cert but JDK doesn't (when it obviously trusts any other letsencrypt cert)?
All reactions