I’m trying to add a MSAD FS Server as Identity Provider in keycloak, which is deployed via the bitnami helm chart.

When I try to enter the discovery endpoint it throws an exception, because the MSAD FS uses a self-signed certificate.

Error:

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
    at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
    at java.base/sun.security.validator.Validator.validate(Validator.java:264)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
    at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
    ... 36 more

I tried to follow the instructions in the values.yaml description in the tls section.

What I did so far:

set tls.enabeld to true
specified existingSecret

I added the ca cert as pem file into the jks (cacerts), named it keycloak.truststore.jks and keycloak.keystore.jks, created a secret

keytool -importcert -file ./custom-cacert.pem -keystore /cacerts

Keycloak regonizes the flag on boot

“The following used options or option values are DEPRECATED and will
be removed in a future release:

• https-trust-store-password: Use the System Truststore instead, see the docs for details.
• proxy: Use proxy-headers.
• https-trust-store-file: Use the System Truststore instead, see the docs for details.”

And listing the certs with keytool inside the container (/opt/bitnami/keycloak/certs/keycloak.truststore.jks) returns the added cert.

So i think the truststore is loaded. But I’m still getting the same error.

Am I missing something or doing wrong? Has anyone an idea how to further analyze the error?