Surviving Certificate Expiry in Enterprise Keycloak: Per-Client Key…
summary
Keycloak generates realm signing certificates with a 10-year hardcoded expiry and many late-2010s installs face imminent expiry; enterprise tenants run hundreds of applications per realm so rotating the single realm key causes outages. OIDC often handles rotation via JWKS but SAML and many vendors use static uploaded certs. Proposed fix is per-client signing key selection (PR #47277): add new key at lower priority, migrate clients one by one, verify and roll back per client, then retire old key.
AI-written summary · about
related talks
27mPreventing Doomsday: x509 Certificates in Cloud Foundry
28mManaging SSH Access without Managing SSH Keys
10mWhy OpenID Connect is More Secure then Certificates
14mKeycloak Journey - Evolution of Business and Community
13mBOSH & SSL Certificates - Rotating Certificates Smoothly
49mHerding Certs - How to Automate Certificate Management
27mScaling Trust: CLM Roadblocks on the Path to Post Quantum Resilience
20mTrust Agility in an Era of Transient Ties: Rethinking TLS...