bypassing certificate is not working in keycloak verison for 26.2.2-0 #39627

PriyankaPanda389 · 2025-05-12T08:00:44Z

PriyankaPanda389
May 12, 2025

In the release notes it was mentioned that we can by pass keycloak certificate check by adding this option --tls-hostname-verifier=ANY
But this option is not working as this is the error i can see in my keycloak logs
what is the solution to this?

Caused by: javax.naming.CommunicationException: 
100.126.24.4:1636 [Root exception is 
javax.net.ssl.SSLHandshakeException: PKIX path 
building failed: 
sun.security.provider.certpath.SunCertPathBuilderExcep
tion: unable to find valid certification path to requested 
target]
at 
java.naming/com.sun.jndi.ldap.Connection.<init>(Conne
ction.java:251)
at 
java.naming/com.sun.jndi.ldap.LdapClient.<init>(LdapCl
ient.java:141)
at 
java.naming/com.sun.jndi.ldap.LdapClientFactory.create

shawkins · 2025-05-12T13:06:22Z

shawkins
May 12, 2025
Collaborator

In the release notes it was mentioned that we can by pass keycloak certificate check by adding this option --tls-hostname-verifier=ANY

What release note are you referring to?

what is the solution to this?

ANY for a couple of releases mistakenly affected what certs were valid - that is not expected behavior, see #38392 and the associated fix.

You are supposed to address this by updating your server truststore to trust the ldap certificate.

If you want new dev mode feature for by-passing certificate validation, that would take a new discussion / enhancement to see if something like that would make sense.

0 replies

Navigation Menu

Repository navigation

bypassing certificate is not working in keycloak verison for 26.2.2-0 #39627

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

bypassing certificate is not working in keycloak verison for 26.2.2-0 #39627

Uh oh!

PriyankaPanda389 May 12, 2025

Replies: 1 comment

Uh oh!

shawkins May 12, 2025 Collaborator

PriyankaPanda389
May 12, 2025

shawkins
May 12, 2025
Collaborator