title: JBoss/Keycloak Server: Update self-signed Server SSl certificate
body: <p>I am managing a keycloak server that runs as a jboss/keycloak image on a synology nas. The keycloak server is configured to use self-signed ssl certificate (signed with our root certificate).
  Now, I created a new root certifacte and signed new server certificates (with openssl). I renamed the server certificate and keyfile to tls.crt and tls.key and uploaded these files to a folder (ssl-Folder) on the nas. The ssl-Folder is mounted in the jboss/keycloak docker image via the docker-compose.yml file:
  volumes:</p>
  <blockquote>
  <p>-ssl-Folder:/etc/x509/https</p>
  </blockquote>
  <p>I restarted the jboss/keycloak docker-container via the terminal command
  sudo docker restart
  Additionally, I restarted the nas hosting the container.</p>
  <p>If I login the running jboss/keycloak docker-container via portainer I can see that the new tls.crt and tls.key files are available within the running container at the path /etc/x509/https and that they are readable for user/group/other. According to jboss/keycloak user guide <a href="https://hub.docker.com/r/jboss/keycloak/" rel="nofollow noreferrer">https://hub.docker.com/r/jboss/keycloak/</a> 1 (Section “Setting up TLS (SSL)”): “The image will automatically convert them into a Java keystore and reconfigure Wildfly to use it”</p>
  <p>However, if I open the address of the keycloak-server in my browser window it is shown that the connection is secured with the old ssl-certificate. It seems to me that the keystore is not updated automatically.</p>
  <p>I further connected to the keycloak admin console and deleted the user/realm/keys cache (Master -&gt; Realm Settings -&gt; Cache). Still the new certificate is not used by the server.</p>
  <p>What do I have to do to make the server use the new ssl-certificates?
  Thank you in advance!</p>