Importing the Certificate into the Keycloak Truststore

Last Updated : Mar 20, 2025 |
Prolog information
Metadata
Keywords:
If your Keycloak installation uses a Java keystore, you must first convert the certificate to the JKS format and then import it into a Java Keystore (JKS) file. To import the certificate into a Keycloak truststore, you must use the truststore used by the Java runtime Keycloak.
  1. Run the following command to import the certificate into a Java Keystore (JKS) file:
    ADDITIONAL INFORMATION:
    keytool -import -alias ldap-server -file ldap-server.crt -keystore truststore.jks -storepass changeit
    Example:
    keytool -import -alias ldap-server -file /home/admin/ldap-server.crt -keystore truststore.jks -storepass changeit
  2. Run the following command to import the certificate into the Keycloak Truststore:
    ADDITIONAL INFORMATION:
    keytool -importcert -file ldap-server.crt -alias ldap-server -keystore /path/to/keycloak/conf/cacerts -storepass changeit
    Example:
    keytool -importcert -file /home/admin/ldap-server.crt -alias ldap-server -keystore /etc/alternatives/jre_17/lib/security/cacerts -storepass changeit
    Following is the location for Keycloak certificate: /etc/alternatives/jre_17/lib/security/
Next steps
Configuring LDAPS in Keycloak
Related links
Initial configuration with the Avaya Aura Device Services configuration utility