Difference between revisions of "Unable to exchange token... tls: failed to verify certificate: x509: certificate signed by unknown authority"
Jump to navigation
Jump to search
| (2 intermediate revisions by the same user not shown) | |||
| Line 2: | Line 2: | ||
Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM[[/protocol/openid-connect/token]]": [[tls: failed to verify certificate: x509]]: [[certificate signed by unknown authority]] | Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM[[/protocol/openid-connect/token]]": [[tls: failed to verify certificate: x509]]: [[certificate signed by unknown authority]] | ||
| − | Solution: add to [[SSL_CERT_FILE]] Temporal | + | Solution: add to [[SSL_CERT_FILE]] [[Temporal web]], see [[Temporal UI OIDC example configuration]] |
[[/auth/sso/callback]] | [[/auth/sso/callback]] | ||
| Line 8: | Line 8: | ||
[[SSL_CERT_FILE]] | [[SSL_CERT_FILE]] | ||
[[/etc/ssl/certs/]] | [[/etc/ssl/certs/]] | ||
| + | [[Issuer]] | ||
kubectl exec -n YOUR_NS keycloak-0 -- [[keytool -printcert -sslserver]] keycloak.your_domain.com:443 | grep -i issuer | kubectl exec -n YOUR_NS keycloak-0 -- [[keytool -printcert -sslserver]] keycloak.your_domain.com:443 | grep -i issuer | ||
Latest revision as of 12:29, 11 July 2026
Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM/protocol/openid-connect/token": tls: failed to verify certificate: x509: certificate signed by unknown authority
Solution: add to SSL_CERT_FILE Temporal web, see Temporal UI OIDC example configuration
/auth/sso/callback SSL_CERT_DIR SSL_CERT_FILE /etc/ssl/certs/ Issuer
kubectl exec -n YOUR_NS keycloak-0 -- keytool -printcert -sslserver keycloak.your_domain.com:443 | grep -i issuer
See also[edit]
- Temporal OIDC, Temporal Auth,
TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars,web.additionalEnvSecretName, Temporal OIDC example configuration /token, Decode token: iss,/userinfo, /authorize,token_endpoint_auth_method,token_type, Bearer,invalid_grant,invalid_client,/.well-known/openid-configuration,/oauth2/v1/token, Token metadata- /auth/, /auth/sso/callback, /auth/callback
- Temporal TLS:
server.config.tls [ .internode | .frontend ], Ports,web.additionalEnvfor Temporal UI,requireClientAuth(mTLS),/etc/temporal/certs/,TEMPORAL_TLS_vars:TEMPORAL_TLS - Temporal UI, oAuth,
web.,temporal-web,web.additionalEnv, web.additionalEnvSecretName,temporalio/ui, Env variables,ExtraObjects
Advertising:
