Unable to exchange token... tls: failed to verify certificate: x509: certificate signed by unknown authority

Unable to exchange token: Post "https://keycloak.yourdomain.como/realms/YOURREALM/protocol/openid-connect/token": tls: failed to verify certificate: x509: certificate signed by unknown authority

Solution: add to SSL_CERT_FILE Temporal web, see Temporal UI OIDC example configuration

/auth/sso/callback
SSL_CERT_DIR
SSL_CERT_FILE
/etc/ssl/certs/
Issuer

kubectl exec -n YOUR_NS keycloak-0 -- keytool -printcert -sslserver keycloak.your_domain.com:443 | grep -i issuer

See also

• Temporal OIDC, Temporal Auth, TEMPORAL_AUTH_ENABLED, TEMPORAL_AUTH_CLIENT_ID, TEMPORAL_AUTH_CLIENT_SECRET, TEMPORAL_AUTH_SCOPES, Web UI, Web UI vars, web.additionalEnvSecretName, Temporal OIDC example configuration
• /token, Decode token: iss, /userinfo, /authorize, token_endpoint_auth_method, token_type, Bearer, invalid_grant, invalid_client, /.well-known/openid-configuration, /oauth2/v1/token, Token metadata
• /auth/, /auth/sso/callback, /auth/callback
• Temporal TLS: server.config.tls [ .internode | .frontend ], Ports, web.additionalEnv for Temporal UI, requireClientAuth (mTLS), /etc/temporal/certs/, TEMPORAL_TLS_ vars: TEMPORAL_TLS
• Temporal UI, oAuth, web., temporal-web, web.additionalEnv, web.additionalEnvSecretName, temporalio/ui, Env variables, ExtraObjects