When your Keycloak clusters span multiple regions, mutual TLS (mTLS) becomes both your best friend and your worst nightmare.
Between certificate rotation, CRL management, and service-to-service trust, a single misconfiguration can isolate an entire region.

In this talk, I’ll walk through how we built and automated a multi-region Keycloak setup with mTLS at scale, securing communication across private and public networks while keeping latency and operational overhead under control.

I’ll talk about:
• What mTLS is and why it’s critical in modern IAM setups
• How Certificate Revocation Lists (CRL) work and why they matter
• How to configure Keycloak to use both mTLS and CRL validation
• The complexities of multi-region architectures:
• Active-active vs. active-passive (our case)
• Observability: how to detect, debug, and monitor broken trust chains
• A live demo showing how certificate revocation and renewal propagate across regions

You’ll leave with a step-by-step understanding of mTLS and CRL setup for Keycloak, plus practical strategies to keep your cross-region identity infrastructure both secure and resilient.