Enabling TLS

Any request to and from Keycloak should be made through a secure channel. For that, you must enable HTTP over TLS, also known as HTTPS. In a nutshell, you should never expose Keycloak endpoints through plain HTTP.

Keycloak exchanges sensitive data all the time with user agents and applications. Enabling HTTPS is crucial to prevent several forms of attacks, as well as to benefit from different forms of authentication that rely on a TLS session established with the server.

The current best practice is to select a key size of at least 2,048 bits. In terms of protocol, Keycloak advertises the most secure protocols, such as TLS v1.2 and TLS v1.3. You should also be able to restrict the list of protocols to only advertise those you want by setting the https-protocols option. For more details, look at the documentation available from https://www.keycloak.org/server/enabletls#_relevant_options.

The first step to enable HTTPS is to create or reuse a Java KeyStore where...