> ## Documentation Index
> Fetch the complete documentation index at: https://anaconda.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# LDAPS

LDAPS is used to secure your LDAP connection. Refer to the [Keycloak documentation on LDAP](https://www.keycloak.org/docs/latest/server_admin/#connect-to-ldap-over-ssl) for more information.

Keycloak uses the default location within the container:

```sh theme={null}
/opt/jboss/keycloak/standalone/configuration/keystores=
```

Copy in your certificate authority (CA):

```sh theme={null}
# Replace <CA.pem> with your certificate authority.
# Replace <container_ID> with your container ID.
docker ps|grep cloak
docker cp <CA.pem> <container_ID>:/opt/jboss
```

Drop into the container:

```sh theme={null}
# Replace <container_ID> with your container ID.
docker exec -u root -it <container_ID> /bin/bash
```

Add the keystore:

```sh theme={null}
# Replace <CA.pem> with your certificate authority.
cd /opt/jboss/keycloak/standalone/configuration/keystores
keytool -keystore truststore -storepass anaconda -noprompt -trustcacerts -importcert -alias ldap-ca -file /opt/jboss/<CA.pem>
```

Add the following to the CA certs bundle:

```sh theme={null}
# Replace <CA.pem> with your certificate authority.
cp /opt/jboss/<CA.pem> /etc/pki/ca-trust/source/anchors/
update-ca-trust
```

This will update the CA certs bundle found in the following file path:

```sh theme={null}
/etc/pki/ca-trust/extracted/java
```

Restart the container:

```sh theme={null}
# Replace <container_ID> with your container ID.
docker ps|grep cloak
docker restart <container_ID>
```

## Troubleshooting

If you have any issues, verify the CA against the LDAPS server:

```sh theme={null}
# Replace <CA.pem> with your certificate authority.
openssl s_client -CAfile <CA.pem> -connect ldapserver.com:636
```

This should return the following string:

```sh theme={null}
Verify return code: 0 (ok)
```

You can inspect the keystore you created with the following command:

```sh theme={null}
keytool -list -v -keystore /opt/jboss/keycloak/standalone/configuration/keystores/truststore -storepass anaconda
```