1 前言

一个问题，一篇文章，一出故事。
笔者今天登陆Nextcloud Keycloak环境时候报错，错误截图我这里不提供，登陆连接如下，
https://nextcloud.cmdschool.org/index.php/apps/user_saml/saml/login?idp=1
使用如下命令查看Keycloak认证端日志，

tail -f /var/log/keycloak/keycloak.log

可见如下错误提示，

2025-10-17 09:36:40,758 ERROR [org.keycloak.protocol.saml.SamlService] (executor-thread-1998) request validation failed: org.keycloak.common.VerificationException: Certificate is not valid.
        at org.keycloak.protocol.saml.SamlProtocolUtils.getPublicKey(SamlProtocolUtils.java:136)
        at org.keycloak.protocol.saml.SamlProtocolUtils.getSignatureValidationKey(SamlProtocolUtils.java:111)
        at org.keycloak.protocol.saml.SamlService$RedirectBindingProtocol.verifySignature(SamlService.java:837)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.handleSamlRequest(SamlService.java:318)
        at org.keycloak.protocol.saml.SamlService$BindingProtocol.execute(SamlService.java:723)
        at org.keycloak.protocol.saml.SamlService.redirectBinding(SamlService.java:891)
        at org.keycloak.protocol.saml.SamlService$quarkusrestinvoker$redirectBinding_f029009a8f864880d0a24aa96e434ce2f5c9e801.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:638)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2675)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2654)
        at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1627)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1594)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:840)

2 最佳实践

2.1 原因分析

经查以上错误是由于证书创建时执行如下命令导致（默认证书30天过期），

openssl req  -nodes -new -x509  -keyout private.key -out public.cert

正确的设置方式是定义证书的有效期为10年或者其他，

openssl req  -nodes -new -x509  -keyout private.key -out public.cert -days 3650

2.2 修复教程

如何配置Nextcloud集成Keycloak？

按照以上文档重新创建新的证书并在对应的设置位置替换Nextcloud和Keycloak的证书。

参阅文档
===================
https://www.haproxy.com/documentation/haproxy-configuration-tutorials/alerts-and-monitoring/email-alerts/#see-also