Difference between revisions of "Unable to exchange token... tls: failed to verify certificate: x509: certificate signed by unknown authority"
Jump to navigation
Jump to search
| Line 2: | Line 2: | ||
Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM[[/protocol/openid-connect/token]]": [[tls: failed to verify certificate: x509]]: [[certificate signed by unknown authority]] | Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM[[/protocol/openid-connect/token]]": [[tls: failed to verify certificate: x509]]: [[certificate signed by unknown authority]] | ||
| + | Solution: add to [[SSL_CERT_FILE]] Temporal | ||
[[/auth/sso/callback]] | [[/auth/sso/callback]] | ||
Revision as of 10:08, 19 June 2026
Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM/protocol/openid-connect/token": tls: failed to verify certificate: x509: certificate signed by unknown authority
Solution: add to SSL_CERT_FILE Temporal
/auth/sso/callback SSL_CERT_DIR SSL_CERT_FILE /etc/ssl/certs/
kubectl exec -n YOUR_NS keycloak-0 -- keytool -printcert -sslserver keycloak.your_domain.com:443 | grep -i issuer
See also
- Temporal OIDC, Temporal Auth,
TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars,web.additionalEnvSecretName, Temporal OIDC example configuration /token, Decode token: iss,/userinfo, /authorize,token_endpoint_auth_method,token_type, Bearer,invalid_grant,invalid_client,/.well-known/openid-configuration,/oauth2/v1/token, Token metadata- /auth/, /auth/sso/callback, /auth/callback
- Temporal TLS:
server.config.tls [ .internode | .frontend ], Ports,web.additionalEnvfor Temporal UI,requireClientAuth(mTLS),/etc/temporal/certs/,TEMPORAL_TLS_vars:TEMPORAL_TLS - Temporal UI, oAuth,
web.,temporal-web,web.additionalEnv, web.additionalEnvSecretName,temporalio/ui, Env variables,ExtraObjects
Advertising:
