Repository navigation
|
I'm trying to configure a custom truststore in Keycloak as per the documentation However, I'm encountering an issue with the keystore password. The Keycloak documentation states that the truststore must be unencrypted (i.e., no password). Starting with certain JDK versions, keytool requires a password for keystore creation, and unencrypted keystores are no longer supported. This leaves me confused about how to proceed. Should I:
Idea is that with init container I would create a truststore when keycloak pod starts up. Additionally, documentation states that we can just include .pem file and this will be recognized as certificate and loaded in. |
Replies: 1 comment 2 replies
|
See this comment #28007 (reply in thread) and the surrounding discussion.
Use debug logging and see if there are messages about why the .pem files are not being used. It is not documented, but the logic is certainly capable of picking up .der files because the java.security.cert.CertificateFactory.generateCertificate method can parse either pem or der. |
|
Thank you for your help! I discovered that the original files were corrupted. @shawkins |
You should be able to see they are trusted by using the SimpleHttpClient or by making a secure LDAP connection. |
See this comment #28007 (reply in thread) and the surrounding discussion.
Use debug logging and see if there are messages about why the .pem files are not being used.
It is not documented, but the logic is certainly capable of picking up .der files because the java.security.cert.CertificateFactory.generateCertificate method can parse either pem or der.