Keycloak not able to connect to Aurora DB in production mode

Hi There,

I am migrating our current keycloak stack to Quarkus with Keycloak version 18.0. I am running keycloak in production mode in docker container behind the load balancer and with 2 keycloak instances (EC2 nodes). My DB is running on Aurora cluster. I configured below env variables for DB configuration.

KC_DB_URL_HOST
KC_DB_USERNAME
KC_DB_PASSWORD

But when I start keycloak, I get below error. Is there any other env variable I need to set? Any help would be really appreciated.

2022-05-02 18:43:36,765 WARN [io.agroal.pool] (agroal-11) Datasource ‘’: Cannot open file:NONE [NONE (No such file or directory)]
2022-05-02 18:43:36,765 DEBUG [io.agroal.pool] (agroal-11) Cause: : java.sql.SQLNonTransientConnectionException: Cannot open file:NONE [NONE (No such file or directory)]
at com.mysql.cj.jdbc.exceptions.SQLError.createSQLException(SQLError.java:110)
at com.mysql.cj.jdbc.exceptions.SQLExceptionsMapping.translateException(SQLExceptionsMapping.java:70)
at com.mysql.cj.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:829)
at com.mysql.cj.jdbc.ConnectionImpl.(ConnectionImpl.java:449)
at com.mysql.cj.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:242)
at com.mysql.cj.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:198)
at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:416)
at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:128)
at com.mysql.cj.jdbc.MysqlDataSource.getConnection(MysqlDataSource.java:113)
at com.mysql.cj.jdbc.MysqlXADataSource.getXAConnection(MysqlXADataSource.java:52)
at io.agroal.pool.ConnectionFactory.createConnection(ConnectionFactory.java:216)
at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:513)
at io.agroal.pool.ConnectionPool$CreateConnectionTask.call(ConnectionPool.java:494)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at io.agroal.pool.util.PriorityScheduledExecutor.beforeExecute(PriorityScheduledExecutor.java:75)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1126)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: com.mysql.cj.exceptions.SSLParamsException: Cannot open file:NONE [NONE (No such file or directory)]
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:490)
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:61)
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:105)
at com.mysql.cj.exceptions.ExceptionFactory.createException(ExceptionFactory.java:151)
at com.mysql.cj.protocol.ExportControlled.getSSLContext(ExportControlled.java:579)
at com.mysql.cj.protocol.ExportControlled.performTlsHandshake(ExportControlled.java:333)
at com.mysql.cj.protocol.StandardSocketFactory.performTlsHandshake(StandardSocketFactory.java:194)
at com.mysql.cj.protocol.a.NativeSocketConnection.performTlsHandshake(NativeSocketConnection.java:101)
at com.mysql.cj.protocol.a.NativeProtocol.negotiateSSLConnection(NativeProtocol.java:308)
at com.mysql.cj.protocol.a.NativeAuthenticationProvider.connect(NativeAuthenticationProvider.java:204)
at com.mysql.cj.protocol.a.NativeProtocol.connect(NativeProtocol.java:1369)

My load balancer is acting as a reverse proxy and I am terminating SSH on LB (KC_PROXY=edge). Is it related to this setup?

That’s SSL error for DB connection.

Configure db-url-properties: Configuring the database - Keycloak
which allow to create TLS connection to your DB
Security with Amazon Aurora MySQL - Amazon Aurora

I guess the most basic and insecure options will be
verifyServerCertificate=false&useSSL=true&requireSSL=true

Thanks for the reply. I setup below env variable
KC_DB_URL_PROPERTIES=“verifyServerCertificate=false&useSSL=true&requireSSL=true” but still seeing the same problem