Start Keycloak Container in HTTPS #5497

damienbod · 2024-08-30T13:06:29Z

damienbod
Aug 30, 2024

I want to run the Keycloak container using HTTPS, not HTTP

Any ideas how to set this up?

var keycloak = builder.AddKeycloak("keycloak", 8081)
    .WithDataVolume();

davidfowl · 2024-08-30T19:23:31Z

davidfowl
Aug 30, 2024
Collaborator

With lots of pain, generating a certificate, and wiring it up appropriately. @DamianEdwards has a sample https://github.com/dotnet/aspire-samples/blob/b741f5e78a86539bc9ab12cd7f4a5afea7aa54c4/samples/Keycloak/Keycloak.AppHost/KeycloakExtensions.cs#L18

4 replies

DamianEdwards Aug 30, 2024
Collaborator

That sample just reuses the ASP.NET Core dev cert rather than generating another, as it's likely to already be trusted. It exports it to a file using dotnet dev-certs in a deterministic temp location, bind mounts it into the container, and uses the Keycloak container's existing support for supplying an HTTPS cert file path via environment variables to configure it.

damienbod Aug 31, 2024
Author

@DamianEdwards Works great thanks

I had to add an extra parameter to fix the port in the WithHttpsEndpoint method.

I can make a PR in the samples if you want

Greetings Damien

AkselKP Oct 7, 2025

Does this breaking change break this solution?
https://learn.microsoft.com/en-us/dotnet/core/compatibility/aspnet-core/9.0/certificate-export

DamianEdwards Oct 13, 2025
Collaborator

@AkselKP The sample was updated to handle that https://github.com/dotnet/aspire-samples/blob/damianedwards/keycloak-sample/samples/Keycloak/Keycloak.AppHost/HostingExtensions.cs#L89

Note that the code in that branch has been refined and improved upon in other places including the CommunityToolkit here. We're working on a first-class feature for this scenario (using the dev cert for non-project resources) which we hope to be included in the next version of Aspire.

damienbod · 2024-09-03T06:53:48Z

damienbod
Sep 3, 2024
Author

I have one HTTPS problem left. The Keycloak server (inside the container) needs to call the web applications in the host env (backchannel logout). The host.docker.internal is used for this. Do you now if it is possible to configure this to work with HTTPS in .NET Aspire? This will work in production, but dev would be cool as well :)

I am thinking of using ngrok, make a public URL and use this for the backchannel post request, but this is not really practical.

Demo project: https://github.com/damienbod/keycloak-backchannel

Greetings Damien

0 replies

damienbod · 2024-09-03T12:22:19Z

damienbod
Sep 3, 2024
Author

@rufer7 Provided this solution which works:

var keycloak = builder.AddKeycloakContainer("keycloak",
            userName: userName, password: password, port: 8080)
    .WithArgs("--features=preview")
    .WithArgs("--spi-connections-http-client-default-disable-trust-manager=true")
    .WithDataVolume()
    .RunWithHttpsDevCertificate(port: 8081);

1 reply

rufer7 Sep 3, 2024

Just make sure to only use this setting in local dev env!

For more details about disable-trust-manager setting see here

LethargicDeveloper · 2024-10-24T15:24:12Z

LethargicDeveloper
Oct 24, 2024

I've setup the Keycloak container to use HTTPS in Aspire using the following extension method

public static IResourceBuilder<KeycloakResource> WithHttpsEndpointWithCertificate(this IResourceBuilder<KeycloakResource> builder, int port)
{
    builder
        .WithHttpsEndpoint(env: "KC_HTTPS_PORT", port: port, targetPort: 8443)
        .WithEnvironment("KC_HTTPS_CERTIFICATE_FILE", "/certs/cert.pem")
        .WithEnvironment("KC_HTTPS_CERTIFICATE_KEY_FILE", "/certs/key.pem")
        .WithEnvironment("KC_HOSTNAME", "localhost")
        .WithEnvironment("KC_HTTP_ENABLED", "false")
        .WithEnvironment("QUARKUS_HTTP_HTTP2", "false")
        .WithBindMount("../../.cert", "/certs");

    return builder;
}

An HTTPS endpoint shows up in the aspire dashboard and that works. In my api project I've set up keycloak like this:

services.AddKeycloakWebApiAuthentication(
    builder.Configuration,
    auth =>
    {
        auth.Audience = "hypercube";
    });
    
services.AddOpenApiDocument(options =>
{
    options.Title = "Hypercube API";
    options.Version = "v1";
    options.DocumentName = "v1";

    var keycloakOptions = builder.Configuration.GetKeycloakOptions<KeycloakAuthenticationOptions>()!;

    options.AddSecurity("oauth2", new NSwag.OpenApiSecurityScheme
    {
        Type = NSwag.OpenApiSecuritySchemeType.OAuth2,
        Description = "OAuth2 Implicit Grant",
        OpenIdConnectUrl = $"{config["Keycloak:AuthServerUrl"]}/realms/hypercube/.well-known/openid-configuration",
        Flows = new NSwag.OpenApiOAuthFlows
        {
            Implicit = new NSwag.OpenApiOAuthFlow
            {
                AuthorizationUrl = keycloakOptions.KeycloakTokenEndpoint.Replace("/token", "/auth"),
                Scopes = new Dictionary<string, string>
                {
                    { "openid", "OpenID Connect scope" },
                    { "profile", "Profile scope" },
                    { "email", "Email scope" },
                }
            }
        }
    });

    options.OperationProcessors.Add(new AspNetCoreOperationSecurityScopeProcessor("oauth2"));
});

The problem is the Keycloak:AuthServerUrl and the TokenEndpointUrl still return the HTTP endpoint NOT the HTTPS endpoint. How do I get Keycloak to default to the configured HTTPS endpoint instead of HTTP? Or what is the appropriate way to configure that on the api side of things?

1 reply

DamianEdwards Oct 24, 2024
Collaborator

Where is Keycloak:AuthServerUrl coming from? Can you show the code from the app host that sets that?

LethargicDeveloper · 2024-10-24T21:27:23Z

LethargicDeveloper
Oct 24, 2024

I feel silly. I wasn't even using Microsoft's keycloak aspire package (Aspire.Hosting.Keycloak). I was using a different one (Keycloak.AuthServices.Aspire.Hosting). It looks like the AuthServerUrl is hardcoded to http in the library I'm using. Not sure you can switch it...

When I try switching to Aspire.Hosting.Keycloak I have other issues, probably related to the aspire workload. I'll just wait until it gets officially released before I switch over to it.

1 reply

DamianEdwards Oct 24, 2024
Collaborator

If it helps, there's an in-progress Keycloak you can reference at https://github.com/dotnet/aspire-samples/tree/damianedwards/keycloak-sample/samples/Keycloak

gregpakes · 2025-12-08T13:08:12Z

gregpakes
Dec 8, 2025

Is this still the recommended advice? This is a little problematic on a Mac.

19 replies

danegsta Dec 19, 2025
Collaborator

This is now available in the stable Aspire 13.1 release.

gregpakes Jan 8, 2026

@danegsta

I can't even get the dashboard to load in 13.1.

In the browsere console I get:

Error: Grpc.Core.RpcException: Status(StatusCode="Internal", Detail="Error starting gRPC call. HttpRequestException: The SSL connection could not be established, see inner exception. AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot", DebugException="System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.")
 ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
 ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot

Here is my dev-cert info:

gregpakes@Mac ~ % dotnet dev-certs https --check -v --trust
[1] Listing certificates from CurrentUser\My
[2] Found certificates: 1 certificate
    1) 1FDF7793584C0C0A441A94E66449C6F66BB27BFD - CN=localhost - Valid from 2025-11-17 10:10:26Z to 2026-11-17 10:10:26Z - IsHttpsDevelopmentCertificate: true - IsExportable: true
[3] Checking certificates validity
[4] Valid certificates: 1 certificate
    1) 1FDF7793584C0C0A441A94E66449C6F66BB27BFD - CN=localhost - Valid from 2025-11-17 10:10:26Z to 2026-11-17 10:10:26Z - IsHttpsDevelopmentCertificate: true - IsExportable: true
[5] Invalid certificates: no certificates
[6] Finished listing certificates.
[23] Saving certificate '1FDF7793584C0C0A441A94E66449C6F66BB27BFD - CN=localhost - Valid from 2025-11-17 10:10:26Z to 2026-11-17 10:10:26Z - IsHttpsDevelopmentCertificate: true - IsExportable: true' to /var/folders/fw/t8j0txw56sq1j9597g9brsh40000gn/T/tmpsPPI2J.tmp without private key.
[25] Creating directory /var/folders/fw/t8j0txw56sq1j9597g9brsh40000gn/T.
[27] Writing the certificate to: /var/folders/fw/t8j0txw56sq1j9597g9brsh40000gn/T/tmpsPPI2J.tmp.
A trusted certificate was found: 1FDF7793584C0C0A441A94E66449C6F66BB27BFD - CN=localhost - Valid from 2025-11-17 10:10:26Z to 2026-11-17 10:10:26Z - IsHttpsDevelopmentCertificate: true - IsExportable: true

DamianEdwards Jan 8, 2026
Collaborator

Which browser are you using? You can try cleaning and recreating your certs:

> dotnet dev-certs https --clear
> dotnet dev-certs https --trust

gregpakes Jan 9, 2026

I did that - Issue persists.

Using Edge on Mac 26.1.

gregpakes Jan 9, 2026

Reboot fixed.... 🤦‍♂️

Start Keycloak Container in HTTPS #5497

Uh oh!

Uh oh!

Replies: 6 comments · 26 replies

Uh oh!

davidfowl Aug 30, 2024 Collaborator

Uh oh!

DamianEdwards Aug 30, 2024 Collaborator

Uh oh!

damienbod Aug 31, 2024 Author

Uh oh!

Uh oh!

DamianEdwards Oct 13, 2025 Collaborator

Uh oh!

Uh oh!

damienbod Sep 3, 2024 Author

Uh oh!

damienbod Sep 3, 2024 Author

Uh oh!

Uh oh!

Uh oh!

DamianEdwards Oct 24, 2024 Collaborator

Uh oh!

Uh oh!

DamianEdwards Oct 24, 2024 Collaborator

Uh oh!

Uh oh!

danegsta Dec 19, 2025 Collaborator

Uh oh!

Uh oh!

DamianEdwards Jan 8, 2026 Collaborator

Uh oh!

Uh oh!

Uh oh!

Replies: 6 comments 26 replies

davidfowl
Aug 30, 2024
Collaborator

DamianEdwards Aug 30, 2024
Collaborator

damienbod Aug 31, 2024
Author

DamianEdwards Oct 13, 2025
Collaborator

damienbod
Sep 3, 2024
Author

damienbod
Sep 3, 2024
Author

DamianEdwards Oct 24, 2024
Collaborator

DamianEdwards Oct 24, 2024
Collaborator

danegsta Dec 19, 2025
Collaborator

DamianEdwards Jan 8, 2026
Collaborator