Difference between revisions of "Unable to exchange token... tls: failed to verify certificate: x509: certificate signed by unknown authority"
Jump to navigation
Jump to search
| Line 8: | Line 8: | ||
[[SSL_CERT_FILE]] | [[SSL_CERT_FILE]] | ||
[[/etc/ssl/certs/]] | [[/etc/ssl/certs/]] | ||
| + | [[Issuer]] | ||
kubectl exec -n YOUR_NS keycloak-0 -- [[keytool -printcert -sslserver]] keycloak.your_domain.com:443 | grep -i issuer | kubectl exec -n YOUR_NS keycloak-0 -- [[keytool -printcert -sslserver]] keycloak.your_domain.com:443 | grep -i issuer | ||
Revision as of 10:09, 19 June 2026
Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM/protocol/openid-connect/token": tls: failed to verify certificate: x509: certificate signed by unknown authority
Solution: add to SSL_CERT_FILE Temporal
/auth/sso/callback SSL_CERT_DIR SSL_CERT_FILE /etc/ssl/certs/ Issuer
kubectl exec -n YOUR_NS keycloak-0 -- keytool -printcert -sslserver keycloak.your_domain.com:443 | grep -i issuer
See also
- Temporal OIDC, Temporal Auth,
TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars,web.additionalEnvSecretName, Temporal OIDC example configuration /token, Decode token: iss,/userinfo, /authorize,token_endpoint_auth_method,token_type, Bearer,invalid_grant,invalid_client,/.well-known/openid-configuration,/oauth2/v1/token, Token metadata- /auth/, /auth/sso/callback, /auth/callback
- Temporal TLS:
server.config.tls [ .internode | .frontend ], Ports,web.additionalEnvfor Temporal UI,requireClientAuth(mTLS),/etc/temporal/certs/,TEMPORAL_TLS_vars:TEMPORAL_TLS - Temporal UI, oAuth,
web.,temporal-web,web.additionalEnv, web.additionalEnvSecretName,temporalio/ui, Env variables,ExtraObjects
Advertising:
