Cannot connect Keycloak with SMTP TLS enable

laurentgrangeau · May 18, 2020, 1:22pm

Hi there,
I have a problem right now with SMTP and TLS. I have a Postfix configured on a VM and want to send mail from Keycloak installed into another VM.
I have configured the host, port and everything on keycloak but it keeps telling me that the certificate is not known.
I have generated a self-sign certificate for my email server, and imported it in the keystore :
keytool -importcert -alias smtp-10-0-7-50 -keystore /opt/keycloak/standalone/configuration/keycloak.keystore -file /home/outscale/smtpd.cert
I then restarted keycloak but it seems that the certificate is not imported

Here is the stacktrace I have :
javax.mail.MessagingException: Could not convert socket to TLS;
nested exception is:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

I have seen in the source code that maybe you can bypass the host verification but I don’t see where I can put it in the configuration files :

github.com

keycloak/keycloak/blob/1f02f87a6e2930ce9c947db9ad5e47eebb46ca9d/services/src/main/java/org/keycloak/email/DefaultEmailSenderProvider.java#L188



private void setupTruststore(Properties props) {
    boolean checkServerIdentity = true;

    JSSETruststoreConfigurator configurator = new JSSETruststoreConfigurator(session);

    SSLSocketFactory factory = configurator.getSSLSocketFactory();
    if (factory != null) {
        props.put("mail.smtp.ssl.socketFactory", factory);
        if (configurator.getProvider().getPolicy() == HostnameVerificationPolicy.ANY) {
            props.setProperty("mail.smtp.ssl.trust", "*");
            checkServerIdentity = false;
        }
    }

    if (checkServerIdentity) {
        props.put("mail.smtp.ssl.checkserveridentity", "true");
    }
}

@Override

Can you help me please ?

efimovms · June 18, 2020, 4:43pm

We have exactly the same issue with keycloak:10.0.2. We are trying to setup connection to an STARTTLS SMPT server and getting this error:
java.io.IOException: Can't verify identity of server

Topic		Replies	Views
Send email keycloak smtp, unable to find certificates Configuring the server	0	728	May 27, 2022
Trust Certificates from Mailserver and LDAP-Server Getting advice	0	505	June 15, 2023
Could not convert socket to TLS	1	2065	November 12, 2021
TLS / SSL configuration within Kubernetes cluster Configuring the server	7	6725	December 30, 2020
Send Certificate Signed Email From Keycloak to SMTP Server Getting advice	0	1828	July 22, 2020

Cannot connect Keycloak with SMTP TLS enable

Related topics