bin/kc.[sh|bat] start --https-certificate-file=/path/to/certfile.pem --https-certificate-key-file=/path/to/keyfile.pemTransport Layer Security (short: TLS) is crucial to exchange data over a secured channel. For production environments, you should never expose Keycloak endpoints through HTTP, as sensitive data is at the core of what Keycloak exchanges with other applications. In this guide, you will learn how to configure Keycloak to use HTTPS/TLS.
Keycloak can be configured to load the required certificate infrastructure using files in PEM format or from a Java Keystore. When both alternatives are configured, the PEM files takes precedence over the Java Keystores.
When you use a pair of matching certificate and private key files in PEM format, you configure Keycloak to use them by running the following command:
bin/kc.[sh|bat] start --https-certificate-file=/path/to/certfile.pem --https-certificate-key-file=/path/to/keyfile.pemKeycloak creates a keystore out of these files in memory and uses this keystore afterwards.
When no keystore file is explicitly configured, but http-enabled is set to false, Keycloak looks for a conf/server.keystore file.
As an alternative, you can use an existing keystore by running the following command:
bin/kc.[sh|bat] start --https-key-store-file=/path/to/existing-keystore-fileRecognized file extensions for a keystore:
.p12, .pkcs12, and .pfx for a pkcs12 file
.jks, and .keystore for a jks file
.key, .crt, and .pem for a pem file
If your keystore does not have an extension matching its file type, you will also need to set the https-key-store-type option.
You can set a secure password for your keystore using the https-key-store-password option:
bin/kc.[sh|bat] start --https-key-store-password=<value>If no password is set, the default password password is used.
Avoid setting a password in plaintext by using the CLI or adding it to conf/keycloak.conf file.
Instead use good practices such as using a vault / mounted secret. For more detail, see Using a vault and Configuring Keycloak for production.
By default, Keycloak does not enable deprecated TLS protocols. If your client supports only deprecated protocols, consider upgrading the client. However, as a temporary work-around, you can enable deprecated protocols by running the following command:
bin/kc.[sh|bat] start --https-protocols=<protocol>[,<protocol>]To also allow TLSv1.2, use a command such as the following: kc.sh start --https-protocols=TLSv1.3,TLSv1.2.
Keycloak listens for HTTPS traffic on port 8443. To change this port, use the following command:
bin/kc.[sh|bat] start --https-port=<port>By default Keycloak will reload the certificates, keys, and keystores specified in https-* options every hour. For environments where your server keys may need frequent rotation, this allows that to happen without a server restart. You may override the default via the https-certificates-reload-period option. Interval on which to reload key store, trust store, and certificate files referenced by https-* options.
The value may be a java.time.Duration value, an integer number of seconds, or an integer followed by one of the time units [ms, h, m, s, d]. Must be greater than 30 seconds. Use -1 to disable.
| Value | |
|---|---|
|
|
|
|
|
|
|
(default) |
|
|
|
|
|
(default) |
|
|
|
(default) |
|
(default) |
|
|
|
|
|
|
|
(default) |