Use of Windows Keystores/Truststores

[mattgagliardi]

I'm working on a project utilizing Keycloak (on Windows at the moment...in JVM mode, not native); in the prior Wildfly-based versions of it I've been able to leverage the Windows truststore (Windows-ROOT) and keystore (Windows-My) rather than leveraging bare cert/key files or standard Java keystores/truststores. I'm wondering if this capability exists in Quarkus and if so could someone point me towards an example or some documentation? I've spent several hours this morning trying various combinations of the options listed here (link), specifically the items related to "http-ssl-certificate" and have yet to stumble onto anything that allows the server to start. The error I'm consistently getting in the console is:
[org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Key material not provided to setup HTTPS. Please configure your keys/certificates or start the server in development mode.

[sberyozkin]

@cescoffier Hi Clement, does Vert.x HTTP provide such a support ? (Directly at the Vert.x level)

[cescoffier]

I don't think so, but I never used Windows truststores/keystores. So, I don't really understand how they differ from regular PEM/JKS/PCKS12 ones.

[sberyozkin]

I think it is an interposition over a Windows registry or something like that.

[mattgagliardi]

I wish I could provide additional info at the level y’all are likely working at, but that’s probably not gonna happen ;) I know the SunMSCAPI provider is used in the process and the config. is set with options like “javax.net.ssl.keyStoreType”. As I indicated initially I’ve been able to get this working with the WildFly version of Keycloak, just no luck so far with the Quarkus backend.
We’re stuck on Windows ATM and using the native keystore and truststore has some operational benefits…so getting this nailed down, if it’s possible, would be really helpful.

[sberyozkin]

@mattgagliardi At the Quarkus level, when configuring its vertx-http extension which supports HTTP for the endpoints, one can configure the key store type and the key store provider, for example:
https://github.com/quarkusio/quarkus/blob/main/integration-tests/bouncycastle-fips-jsse/src/main/resources/application.properties#L7..L8

So if you need to set up a key store type and a key store provider and it is currently not possible in Quarkus-based Keycloak then please ask the Keycloak team to add these options