You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The default self-signed 10 year certificates deployed by Keycloak don't meet policy or security requirements for SSO / generic APIs (where there is no "revocation" just direct trust of cached public cert).
Desired Functionality
I would like to get short-lived automated certificate rotations handled via Keycloak. Ideally these could be as short as 30 day keys.
The key and certificate should only be valid for a time period specified by policy - such as 45 days maximum lifetime. Then rotate primary, secondary, tertiary, on a defined schedule without any downtime.
Questions / How to go about it
The server guide calls out rotating every 3-6 months but proceeds to mostly tell you how to do it via the GUI, which isn't a feasible rotation strategy. Additionally if the built-in keys are 10 years which is still too long.
"Consider creating new keys every three to six months and deleting old keys one to two months after you create the new keys"
My initial thought was just using the REST API to schedule this. But I can't seem to set a validity period on the generated keys/certs, they're always 10 years expiry. So now considering if the API is even the right approach here.
Is it possible to specify a validity period on the signing keys when using the .../components API request?
Should we instead be doing something like bring-your-own-key with a keystore on the host? Then rotating them in there?
Has anyone actually set this up successfully with 20+ realms all with automatic rotating keys every couple months?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Issue
The default self-signed 10 year certificates deployed by Keycloak don't meet policy or security requirements for SSO / generic APIs (where there is no "revocation" just direct trust of cached public cert).
Desired Functionality
I would like to get short-lived automated certificate rotations handled via Keycloak. Ideally these could be as short as 30 day keys.
The key and certificate should only be valid for a time period specified by policy - such as 45 days maximum lifetime. Then rotate primary, secondary, tertiary, on a defined schedule without any downtime.
Questions / How to go about it
The server guide calls out rotating every 3-6 months but proceeds to mostly tell you how to do it via the GUI, which isn't a feasible rotation strategy. Additionally if the built-in keys are 10 years which is still too long.
"Consider creating new keys every three to six months and deleting old keys one to two months after you create the new keys"
My initial thought was just using the REST API to schedule this. But I can't seem to set a validity period on the generated keys/certs, they're always 10 years expiry. So now considering if the API is even the right approach here.
Is it possible to specify a validity period on the signing keys when using the .../components API request?
Should we instead be doing something like bring-your-own-key with a keystore on the host? Then rotating them in there?
Has anyone actually set this up successfully with 20+ realms all with automatic rotating keys every couple months?
All reactions