x509 Authentication - Keycloak Login #23218

tomastn14 · 2023-09-13T17:48:41Z

tomastn14
Sep 13, 2023

Hello everyone,

In keycloak, i want to log in with users with a personal digital certificate (.p12) that i installed in my browser.

I had configured the bind flow "Browser flow" with x509 username form but when i try to log in the browser don't request the certificate.

Can anyone help me??
Thanks in advance

justin-tay · 2023-09-13T20:04:26Z

justin-tay
Sep 13, 2023

Did you perform all the necessary TLS configuration as described at https://www.keycloak.org/server/enabletls?

2 replies

tomastn14 Sep 13, 2023
Author

Hi!
thanks or your reply!

yes, i have the ssl/tls configuration. I have keycloak deployed in docker and i can acces via https and port 8443.

i want to log in with a certificate that i has installed on my browser, is a personal certificate of my country.

But I think (I must confirm) that the server is behind a proxy, I think it can be a problem too

justin-tay Sep 13, 2023

Did you enable MTLS with the https-client-auth option?

tomastn14 · 2023-09-13T21:05:34Z

tomastn14
Sep 13, 2023
Author

This is mi docker-compose.yml file.

`version: '3'
services:
  keycloak:
    image: 'quay.io/keycloak/keycloak:latest'
    container_name: keycloak
    ports:
      - '8080:8080'
      - '8443:8443'
    volumes:
      - './certs/fullchain.pem:/etc/x509/https/tls.crt'
      - './certs/privkey.pem:/etc/x509/https/tls.key'
      - './certs:/certs'

    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HTTPS_CERTIFICATE_FILE: /etc/x509/https/tls.crt
      KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/x509/https/tls.key
      KC_HTTPS_CLIENT_AUTH: request
    command:
      - start-dev
`

1 reply

justin-tay Sep 13, 2023

If I change https-client-auth to required and attempt to connect I get the following which shows Keycloak is asking for a certificate

tomastn14 · 2023-09-14T07:11:17Z

tomastn14
Sep 14, 2023
Author

Thanks for your help. Its very important for me.

Correct, if I change https-client-auth to required, I get the same error (ERR_BAD_SSL_CLIENT_AUTH_CERT ), but I don't understand it.

I want it to be requested in another realm (not master) when logging in with a user.

In https certificate and https key, I provide keys generated with lets encrypt for my domain where I deploy keycloak. Then in my browser the .p12 certificate is different, it is personal and I want to make it possible to log in with it.

1 reply

justin-tay Sep 14, 2023

MTLS is happening at the transport layer so this is really happening before Keycloak can really process anything.

This may mean that your client certificate is being rejected. You may need to configure a truststore with the CA of your client certificate or your client certificate itself and configure as per https://www.keycloak.org/server/enabletls#_using_a_truststore.

You probably need to make sure your client certificate is accepted before switching https-client-auth back to request.

tomastn14 · 2023-09-14T07:56:54Z

tomastn14
Sep 14, 2023
Author

Ok I have proceeded with your indication.

I have created the truststore with passwor 8000 d "root1234"
keytool -genkey -alias mytruststore -keystore truststore.jks

I add the .p12 certificate that I have installed in my browser.
keytool -importkeystore -srckeystore certificate.p12 -srcstoretype PKCS12 -destkeystore truststore.jks -deststoretype JKS

I have modified the environment of my docker compose file

    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
      KC_HTTPS_CERTIFICATE_FILE: /etc/x509/https/tls.crt
      KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/x509/https/tls.key
      KC_HTTPS_TRUST_STORE_FILE: /certs/truststore.jks
      KC_HTTPS_TRUST_STORE_PASSWORD: root1234
      KC_HTTPS_CLIENT_AUTH: request

But the issue continues

1 reply

justin-tay Sep 14, 2023

You probably should test with https-client-auth as required. Just to confirm, you do have the private key that corresponds to that personal certificate.

justin-tay · 2023-09-14T08:57:47Z

justin-tay
Sep 14, 2023

I did the following steps

Create the client certificate and key

openssl req -nodes -x509 -sha256 -newkey rsa:4096 \
  -keyout admin.key \
  -out admin.crt \
  -days 356 \
  -subj "/CN=Admin"  \
  -addext "extendedKeyUsage = clientAuth"  \
  -addext "keyUsage = digitalSignature, keyEncipherment, dataEncipherment"  \
  -addext "subjectAltName = otherName:1.3.6.1.4.1.311.20.2.3;UTF8:ADMIN@TEST"

Create the trust store for Keycloak

keytool -import -trustcacerts -keystore truststore.p12 -storepass changeit -noprompt -file admin.crt -alias admin

Create the key store to import for the browser

openssl pkcs12 -export -in admin.crt -inkey admin.key -name admin -out admin.p12

In Windows I double-click on admin.p12 to import the certificate and key into the system.

For Keycloak I configure

https-trust-store-file=truststore.p12
https-trust-store-password=changeit

When connecting using Chrome this is what I see

1 reply

NobodyMore Jan 27, 2025

This comment is the only simple tutorial on how to use x.509 of keycloak.

tomastn14 · 2023-09-14T09:00:39Z

tomastn14
Sep 14, 2023
Author

Ok, I think we are close, the problem is the keys.
But I have a .p12 certificate installed in my browser already (it's the one I want to use to log in).

I have exported it to certificate.cer (x509) How can I configure it? or what is the process to follow?

1 reply

justin-tay Sep 14, 2023

Does the certificate in the browser indicate that you have the corresponding private key?

tomastn14 · 2023-09-14T09:25:01Z

tomastn14
Sep 14, 2023
Author

Yes, the certificate in the browser tells me that I have the corresponding private key.

I installed it in .p12 format, it includes the certificate along with the private key.

I can export it with private key to .pfx format.
I can also export only the public key to .cer format.

0 replies

tomastn14 · 2023-09-14T09:31:37Z

tomastn14
Sep 14, 2023
Author

My certificate was generated by the FNMT.

Is it possible that I need AC Root certificate from FNMT?
I have seen that it can be downloaded from here in (.cer) format.
https://www.sede.fnmt.gob.es/en/descargas/certificados-raiz-de-la-fnmt

11 replies

tomastn14 Sep 14, 2023
Author

I have good news.

I have imported the rootCA.cer to truststore.p12

rootCA.cer belongs to my certificate (.p12) that I have installed in my browser.

Now when I access the realm master for the first time, it asks for it (attached screenshot).

Then I create a realm and configure authentication, I create a new browser flow and add x509 validate/username form but it says X509 certificate authentication's failed.
Invalid user

I think this one is not mapping well.

I want, when a user has to login, to do it with his certificate.
The user must be previously created and has to be mapped with his name. In the certificate subject it appears as CN= LASTNAME NAME.
Example: CN= TALAVERA NUÑEZ TOMAS

justin-tay Sep 14, 2023

8BD0

The Keycloak logs should have some error messages that can be helpful to figure out the issue.

Did you configure the X509/Validate Username step to meet your requirements? Namely how to extract the user identity from the certificate and how to lookup the Keycloak user with the user identity. You will likely need to ensure that the Keycloak user already has a user attribute that relates to the user identity from the certificate.

justin-tay Sep 14, 2023

The logic for what it is doing is

keycloak/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java

Lines 47 to 145 in 86c0e33

    
           public void authenticate(AuthenticationFlowContext context) { 
        
               X509Certificate[] certs = getCertificateChain(context); 
        
               if (certs == null || certs.length == 0) { 
        
                   logger.debug("[ValidateX509CertificateUsername:authenticate] x509 client certificate is not available for mutual SSL."); 
        
                   context.getEvent().error(Errors.USER_NOT_FOUND); 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", "X509 client certificate is missing."); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               saveX509CertificateAuditDataToAuthSession(context, certs[0]); 
        
               recordX509CertificateAuditDataViaContextEvent(context); 
        
               X509AuthenticatorConfigModel config = null; 
        
               if (context.getAuthenticatorConfig() != null && context.getAuthenticatorConfig().getConfig() != null) { 
        
                   config = new X509AuthenticatorConfigModel(context.getAuthenticatorConfig()); 
        
               } 
        
               if (config == null) { 
        
                   logger.warn("[ValidateX509CertificateUsername:authenticate] x509 Client Certificate Authentication configuration is not available."); 
        
                   context.getEvent().error(Errors.USER_NOT_FOUND); 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", "Configuration is missing."); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               // Validate X509 client certificate 
        
               try { 
        
                   CertificateValidator.CertificateValidatorBuilder builder = certificateValidationParameters(context.getSession(), config); 
        
                   CertificateValidator validator = builder.build(certs); 
        
                   validator.checkRevocationStatus() 
        
                           .validateTrust() 
        
                           .validateKeyUsage() 
        
                           .validateExtendedKeyUsage() 
        
                           .validateTimestamps() 
        
                           .validatePolicy(); 
        
               } catch(Exception e) { 
        
                   logger.error(e.getMessage(), e); 
        
                   // TODO use specific locale to load error messages 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", e.getMessage()); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               Object userIdentity = getUserIdentityExtractor(config).extractUserIdentity(certs); 
        
               if (userIdentity == null) { 
        
                   context.getEvent().error(Errors.INVALID_USER_CREDENTIALS); 
        
                   logger.errorf("[ValidateX509CertificateUsername:authenticate] Unable to extract user identity from certificate."); 
        
                   // TODO use specific locale to load error messages 
        
                   String errorMessage = "Unable to extract user identity from specified certificate"; 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", errorMessage); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               UserModel user; 
        
               try { 
        
                   context.getEvent().detail(Details.USERNAME, userIdentity.toString()); 
        
                   context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, userIdentity.toString()); 
        
                   user = getUserIdentityToModelMapper(config).find(context, userIdentity); 
        
               } 
        
               catch(ModelDuplicateException e) { 
        
                   logger.modelDuplicateException(e); 
        
                   String errorMessage = String.format("X509 certificate authentication's failed. Reason: \"%s\"", e.getMessage()); 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", errorMessage); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               catch(Exception e) { 
        
                   logger.error(e.getMessage(), e); 
        
                   String errorMessage = String.format("X509 certificate authentication's failed. Reason: \"%s\"", e.getMessage()); 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_request", errorMessage); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               if (user == null) { 
        
                   context.getEvent().error(Errors.INVALID_USER_CREDENTIALS); 
        
                   Response challengeResponse = errorResponse(Response.Status.UNAUTHORIZED.getStatusCode(), "invalid_grant", "Invalid user credentials"); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               String bruteForceError = getDisabledByBruteForceEventError(context, user); 
        
               if (bruteForceError != null) { 
        
                   context.getEvent().user(user); 
        
                   context.getEvent().error(bruteForceError); 
        
                   Response challengeResponse = errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "invalid_grant", "Invalid user credentials"); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               if (!user.isEnabled()) { 
        
                   context.getEvent().user(user); 
        
                   context.getEvent().error(Errors.USER_DISABLED); 
        
                   Response challengeResponse = errorResponse(Response.Status.BAD_REQUEST.getStatusCode(), "invalid_grant", "Account disabled"); 
        
                   context.failure(AuthenticationFlowError.INVALID_USER, challengeResponse); 
        
                   return; 
        
               } 
        
               context.setUser(user); 
        
               context.success(); 
        
           }

tomastn14 Sep 14, 2023
Author

Hello, I just did it, finally created a regular expression to capture the dni that is inside the CN= of the subject of the certificate. This way I map it to the username, which will be the ID in this case as well. Thank you so much for all your help.

jbostoen Mar 15, 2024

@tomastn14 I'm also facing the issue where I believe my national user certificate is correctly present (and can be used to authenticate to other official sites). But despite setting up a truststore and playing around with "request" or "required" values for --https-client-auth, I can't get the browser to show the prompt.

Are you sure it was just adjusting the keystore? Perhaps anything else you remember?

Update: Weird, another restart later and it does work. Perhaps some browser cache thing :/

However, new issue: after entering the PIN code for my (prompted) certificate, I get: ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED . ( I'm directly accessing Keycloak, nothing in between).

Solution: Turns out my smartcard only worked when I only enabled the TLSv1.2 protocol (and unchecked the other ones).

tomastn14 · 2023-09-14T09:55:57Z

tomastn14
Sep 14, 2023
Author

0 replies

david6983 · 2023-09-19T15:05:52Z

david6983
Sep 19, 2023

Hello @tomastn14, here is a working configuration I tested last time for mTLS if you want to compare: #15481 (comment)

0 replies

tomastn14 · 2023-09-25T12:59:42Z

tomastn14
Sep 25, 2023
Author

Hello friends @justin-tay @david6983 , the last question was resolved, but I have a new one.

Previously, I was able to log in with an x509 certificate but having the user created previously.

Now I want to create a registration flow so that if the user is not created, it will be created from the x509 certificate mapping.

How should I configure it?

1 reply

jayteaftw May 5, 2025

@tomastn14 Was this ever solved? I still havent found a way for this besides my current thought of editing the theme to redirect to a whole new user registration page hosted in a different application, and then sending a user creating request using the keycloak SDK.

LyraHarring · 2025-07-22T06:03:57Z

LyraHarring
Jul 22, 2025

The error ERR_BAD_SSL_CLIENT_AUTH_CERT is a security-related bug that appears in web browsers, especially Google Chrome, due to a failure to interact with the SSL/TLS client authentication process. Some of the 10BC8 se are caused by certificate misconfiguration, wrong date and time of the client device, browser, and system software, and interferences from browser plug-ins and anti-virus programs.

0 replies

x509 Authentication - Keycloak Login #23218

Uh oh!

Replies: 12 comments · 19 replies

Uh oh!

Uh oh!

tomastn14 Sep 13, 2023 Author

Uh oh!

Uh oh!

tomastn14 Sep 13, 2023 Author

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

justin-tay Sep 14, 2023 8BD0

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

Uh oh!

Uh oh!

tomastn14 Sep 14, 2023 Author

Uh oh!

Uh oh!

Uh oh!

tomastn14 Sep 25, 2023 Author

Uh oh!

Uh oh!

Replies: 12 comments 19 replies

tomastn14 Sep 13, 2023
Author

tomastn14
Sep 13, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14 Sep 14, 2023
Author

justin-tay Sep 14, 2023

8BD0

tomastn14 Sep 14, 2023
Author

tomastn14
Sep 14, 2023
Author

tomastn14
Sep 25, 2023
Author