Https keycloak does not start

Question

i'm tring to start a keycloak instance on an aws ec2 instance. In particular i'm tring to deploy it with docker, i need this because we are more than 1 persone to work on it.

I bought an ssl certificate on https://sectigo.com/, and i would like to use it so secure this comunication.

This is my docker file:

FROM quay.io/keycloak/keycloak:latest as builder


ENV KC_HEALTH_ENABLED=true 
ENV KC_METRICS_ENABLED=true


ENV KC_DB=postgres

WORKDIR /opt/keycloak

COPY keycloak-server.crt.pem /opt/keycloak/keycloak-server.crt.pem COPY keycloak-server.key.pem /opt/keycloak/keycloak-server.key.pem

ENV KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/keycloak-server.crt.pem ENV KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/keycloak-server.key.pem

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:latest 
COPY --from=builder /opt/keycloak/ /opt/keycloak/


ENV KC_DB=postgres 
ENV KC_DB_URL_DATABASE=keycloakDB 
ENV KC_DB_URL_HOST=****** 
ENV KC_DB_URL_PORT=5432 
ENV KC_DB_USERNAME=**** 
ENV KC_DB_PASSWORD=****** 
ENV KC_HOSTNAME=localhost 
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

After i build the image i start it with this command:

docker run --name mykeycloak -p 8443:8443 -p 8080:8080 -e KEYCLOAK_ADMIN=***** -e KEYCLOAK_ADMIN_PASSWORD=**** mykeycloak start

But it gives me this error:

2023-03-27 23:24:27,150 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (production) mode 2023-03-27 23:24:27,150 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Key material not provided to setup HTTPS. Please configure your keys/certificates or start the server in development mode. 2023-03-27 23:24:27,153 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the details about the usage of the particular command.

Could anyone help me?

I expect to figure out with this problem, launching correctly the instance

Answer 1

I have just experienced this same issue on keycloak version 26.1.2 and I am sharing what I did to make mine work since it is somewhat different from the above suggested answer.

I’m running Keycloak 26.1.2 behind an AWS Load Balancer (reverse proxy) that already terminates HTTPS,and the traffic between the load balancer and Keycloak is over a private network. I resolved the error by explicitly enabling HTTP in Keycloak and configuring it to trust proxy headers.

By setting KC_HTTP_ENABLED=true and KC_PROXY_HEADERS=xforwarded, Keycloak starts in HTTP mode but still serves securely over HTTPS externally.

The AWS Load Balancer handles SSL/TLS encryption, so Keycloak doesn’t need to manage certificates directly.

Important points to note :

1. Ensure your ALB security policies restrict weak protocols and is using up to date TLS (in my case TLS 1.3)
2. Add KC_PROXY=edge (if missing) to ensure Keycloak builds URLs with https:// instead of http://:

Answer 2

Your ENV KC_HTTPS_CERTIFICATE_FILE=... directive is only present in the build step of your docker image process. It needs to be moved to the block of ENV directives below the second FROM, in order to be present at runtime.

Unlike KC_DB, it is a pure runtime value, so it does not need to be present for the build step, only during runtime, so you don't need to copy it, just move it.