The certificate has expired. Your Keycloak realm is now a locked gate.
Keycloak security certificates are at the core of its trust model. They sign tokens, encrypt traffic, and protect identities. Without valid certificates, authentication fails and integrations break. Certificates in Keycloak are tied to realms and clients. They can be self-signed or issued by a trusted Certificate Authority (CA).
Keycloak uses certificates for two primary functions: securing HTTPS endpoints and signing JSON Web Tokens (JWT). HTTPS certificates ensure that user credentials and API calls are encrypted in transit. The signing keys produce digital signatures that clients can verify, preventing tampering and forgery.
Managing certificates in Keycloak requires precision.
- HTTPS/TLS Certificates – Configure these in your reverse proxy or load balancer, or directly in Keycloak if running standalone. Use CA-issued certs for production.
- Realm Keys – Found under Realm Settings > Keys. These contain active and passive keys for signing and encryption. Rotate them on a schedule.
- Client Certificates – For mutual TLS setups, configure trusted certificates on both server and client sides.
Rotation and renewal keep your system secure. Expired or compromised certificates are a direct risk. Use automation to renew TLS certificates (e.g., with Let’s Encrypt) and update realm keys regularly. Test each change in a staging environment before applying it to production.
Importing a certificate into Keycloak involves uploading the key pair in the Admin Console or using the Keycloak Admin REST API. Always ensure private keys remain stored securely. Back them up with strong access controls. Monitor certificate expiry dates with alerts.
For clustered deployments, synchronize all certificate changes across nodes. This prevents mismatched keys from breaking authentication. In containerized or cloud environments, store certificates in secrets managers instead of embedding them in images.
A well-implemented certificate strategy in Keycloak ensures encryption, identity verification, and system integrity. Poor handling leaves openings for attacks.
Get your Keycloak security certificates configured and see a working setup in minutes. Visit hoop.dev and watch it live.