<p>Hi I am at a loss when it comes to configuring OIDC (Keycloak) with MinIO (both are deployed on same AKS cluster). I have configured an Ingress for both, both use the same wildcard cert that I got from DigiCert. However, whenever I got to configure OIDC (either via Helm values or manually in the console) I get the following error:</p>
<pre><code>Get &quot;https://&lt;FQDN_KEYCLOAK&gt;/realms/master/.well-known/openid-configuration&quot;: tls: failed to verify certificate: x509: certificate signed by unknown authority
</code></pre>
<p>I tried to manually mount the tls secret into <code>/etc/minio/certs</code> on the MinIO pod but same error. Any suggestions? Thanks</p>
<p><strong>UPDATE</strong>: I get the same exception when integrating Keycloak (OIDC) with ArgoCD.</p>

user1314147
<p>Since you have an error &quot;<code>TLS: failed to verify certificate: x509: certificate signed by unknown authority</code>&quot;, that should mean that the certificate used by the Keycloak server is not trusted by the system where MinIO and ArgoCD are running.</p>
<p>You should make sure the certificate authority (CA) that signed your certificate is trusted by the MinIO and ArgoCD systems. Since you mentioned that you are using a certificate from DigiCert, it is strange that it is not recognized, as DigiCert is a well-known CA.</p>
<p>First, check that the certificate is correctly installed on the Keycloak server. You can verify the certificate installation using tools like <a href="https://www.openssl.org/" rel="nofollow noreferrer">OpenSSL</a> or <a href="https://www.digicert.com/help/" rel="nofollow noreferrer">online SSL checkers</a>.</p>
<pre class="lang-bash prettyprint-override"><code>openssl s_client -connect &lt;FQDN_KEYCLOAK&gt;:443 -showcerts
</code></pre>
<p>When you run this command, look for the &quot;Certificate chain&quot; section in the output. If you see one, then make sure the certificates for all levels in the chain are present and correctly <a href="https://www.keycloak.org/server/enabletls" rel="nofollow noreferrer">configured in your server configuration, which, in this case, is Keycloak</a>.<br />
The certificates must be concatenated in a single file (<code>https-certificate-file</code>), with the server's certificate first, then the intermediate certificate(s), and finally the root certificate, to form a complete chain.</p>
<p>Update the certificate trust store on the <a href="https://min.io/docs/minio/linux/operations/network-encryption.html" rel="nofollow noreferrer">MinIO</a> and <a href="https://argo-cd.readthedocs.io/en/stable/operator-manual/tls/" rel="nofollow noreferrer">ArgoCD</a> systems to include the CA certificate that signed your Keycloak certificate.</p>
<ul>
<li><p>For MinIO, you need to correctly configure it to trust your CA certificate. You may add your certificate to the system trust store, or configure MinIO to use a custom CA certificate:</p>
<pre><code>mkdir -p /root/.minio/certs/CAs/
cp your-root-ca.crt /root/.minio/certs/CAs/
</code></pre>
<p>Restart the MinIO server after adding the certificates.</p>
</li>
<li><p>Similar to MinIO, for ArgoCD, update the trust store to include your CA certificate.</p>
</li>
</ul>
<p>All this assumes that the FQDN specified in the error message resolves correctly to your Keycloak server and that there are no network issues preventing connectivity.</p>
<p>You can use <code>curl</code> to test the certificate validation manually:</p>
<pre><code>curl -v https://&lt;FQDN_KEYCLOAK&gt;/realms/master/.well-known/openid-configuration --cacert /path/to/your/ca/cert.pem
</code></pre>
<p>If curl command succeeds without certificate errors, it indicates the certificate is correctly installed and trusted.</p>
<hr />
<blockquote>
<p>This is a very strange error, as I have configured both of these services with Keycloak in other K8s environments, it appears to just be this one (running on AKS).</p>
<p>The certs are definitely installed in Keycloak using the Bitnami chart, and that curl command did not return a cert error (both using the above with Keycloak and using the FQDN of argo).</p>
</blockquote>
<p>Since you have successfully configured these services in other Kubernetes environments and are experiencing issues only in this specific AKS cluster, the issue should be specific to this particular AKS environment or the certificates involved. The successful <code>curl</code> command test is a strong indicator that the certificates on the Keycloak server are correctly installed and accessible from within the cluster.</p>
<p>So check aks-specific configurations: AKS might have some specific security policies or networking configurations that affect TLS verification. Confirm that there are no such configurations that may be interfering with the connection to Keycloak.</p>
<p>And review mounted certificates in pods: Inspect MinIO and ArgoCD pods to see whether the CA certificates are correctly mounted and accessible.</p>
<pre class="lang-bash prettyprint-override"><code>kubectl exec -it &lt;pod_name&gt; -n &lt;namespace&gt; -- /bin/sh
ls /etc/minio/certs/CAs/  # or corresponding path
</code></pre>
<p>Make sure that there are no Kubernetes network policies or Azure-specific firewall rules that may be interfering with the certificate verification process.<br />
For instance, use <code>curl</code> from inside other pods in the cluster to rule out any network issues specific to MinIO or ArgoCD.</p>
<pre class="lang-bash prettyprint-override"><code>kubectl run --rm -i --tty --image=busybox testpod -- sh
wget --ca-cert=/path/to/ca.crt https://&lt;FQDN_KEYCLOAK&gt;/realms/master/.well-known/openid-configuration
</code></pre>
<hr />
<p>The <a href="https://stackoverflow.com/users/1314147/user1314147">OP</a> adds in <a href="https://stackoverflow.com/questions/77092098/minio-openid-keycloak-on-aks-failed-to-verify-tls/77141650#comment136118029_77141650">the comments</a>:</p>
<blockquote>
<p>I ended up figuring it out, it was due to 2 issues:</p>
<ul>
<li>I was trying to use one wildcar cert for <code>auth.&lt;BASE_URL&gt;</code> and <code>argo.&lt;BASE_URL&gt;</code>, switched to using letsencrypt and</li>
<li>I needed to concert the certs to PEM format and mount to <code>/opt/bitnami/keycloak/certs</code></li>
</ul>
</blockquote>
<p>True:</p>
<h2>Use of a single wildcard certificate:</h2>
<ul>
<li><p><a href="https://en.wikipedia.org/wiki/Wildcard_certificate" rel="nofollow noreferrer">Wildcard certificates</a> can be convenient for securing multiple subdomains under a single base domain.<br />
However, depending on the issuing Certificate Authority (CA) and the applications involved, wildcard certificates may not always work seamlessly. And using a single certificate for multiple services can sometimes introduce complexities or limitations.</p>
</li>
<li><p>By opting for Let's Encrypt, you could easily issue separate certificates for each subdomain (<code>auth.&lt;BASE_URL&gt;</code> and <code>argo.&lt;BASE_URL&gt;</code>), isolating each service's SSL configuration.<br />
That is generally easier to manage and troubleshoot. Let's Encrypt's automation features can also streamline the renewal process, further reducing maintenance overhead.</p>
</li>
</ul>
<h2>Conversion to PEM format:</h2>
<p>Certificates can come in <a href="https://en.wikipedia.org/wiki/X.509#Certificate_filename_extensions" rel="nofollow noreferrer">various formats</a> like DER, PEM, PFX, etc. The applications involved (in this case, Bitnami's Keycloak chart) might expect the certificates to be in a particular format.</p>
<ul>
<li><p>PEM (Privacy-Enhanced Mail) is one of the most commonly used certificate formats, recognizable by the <code>-----BEGIN CERTIFICATE-----</code> and <code>-----END CERTIFICATE-----</code> delimiters. Not all software can read all formats, so converting to PEM is often necessary for compatibility.</p>
</li>
<li><p>Mounting to <code>/opt/bitnami/keycloak/certs</code>: That is specific to the <a href="https://github.com/bitnami/charts/tree/main/bitnami/keycloak" rel="nofollow noreferrer">Bitnami Keycloak Helm chart</a>. Helm charts usually define specific paths where they expect to find configurations or certificates. You needed to make sure the PEM-formatted certificates were placed in this specific directory for Keycloak to use them properly.</p>
</li>
</ul>
