keycloak/truststore_ldaps at main · tkolaski/keycloak · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

1. Export LDAP server certificate

Run this on a machine that can reach the AD server:

openssl s_client -connect vm-2019-ad.zmbad.local:636 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM > ad-cert.pem

2. Copy the certificate into the Keycloak container
docker cp ad-cert.pem <container>:/opt/keycloak/ad-cert.pem

3. Import into the Java truststore inside the container

4.If you want, I can verify where your truststores are located.
Just run inside the container:

find /opt/keycloak -name cacerts


Enter the container:

docker exec -it <container> /bin/bash


Option 1 — Run a root shell inside the container

Most Keycloak images support this:

docker exec -u 0 -it <container> /bin/bash


Now run the import:

keytool -importcert \
  -keystore /etc/java/java-21-openjdk/java-21-openjdk-21.0.9.0.10-1.el9.x86_64/lib/security/cacerts \
  -storepass changeit \
  -alias vm-2019-ad \
  -file /opt/keycloak/ad-cert.pem \
  -noprompt


It should succeed without the “Permission denied” error.

Option 2 — Temporarily grant write permissions

(Use only if root shell fails)

docker exec -u 0 <container> chmod 644 /etc/java/java-21-openjdk/.../cacerts


Then import the cert (as non-root):

docker exec -it <container> keytool -importcert \
  -keystore /etc/java/java-21-openjdk/.../cacerts \
  -storepass changeit \
  -alias vm-2019-ad \
  -file /opt/keycloak/ad-cert.pem \
  -noprompt


Then lock permissions again:

docker exec -u 0 <container> chmod 640 /etc/java/java-21-openjdk/.../cacerts

❗ After importing the certificate, restart the container:
docker restart <container>


If you want, tell me your container name and I’ll give you the exact commands copy/paste-ready.