Keycloak security certificates are at the core of its trust model. They sign tokens, encrypt traffic, and protect identities. Without valid certificates, authentication fails and integrations break. Certificates in Keycloak are tied to realms and clients. They can be self-signed or issued by a trusted Certificate Authority (CA).
Keycloak uses certificates for two primary functions: securing HTTPS endpoints and signing JSON Web Tokens (JWT). HTTPS certificates ensure that user credentials and API calls are encrypted in transit. The signing keys produce digital signatures that clients can verify, preventing tampering and forgery.
Managing certificates in Keycloak requires precision.
- HTTPS/TLS Certificates – Configure these in your reverse proxy or load balancer, or directly in Keycloak if running standalone. Use CA-issued certs for production.
- Realm Keys – Found under Realm Settings > Keys. These contain active and passive keys for signing and encryption. Rotate them on a schedule.
- Client Certificates – For mutual TLS setups, configure trusted certificates on both server and client sides.
Rotation and renewal keep your system secure. Expired or compromised certificates are a direct risk. Use automation to renew TLS certificates (e.g., with Let’s Encrypt) and update realm keys regularly. Test each change in a staging environment before applying it to production.