Unraid API Keycloak Authentication with Custom Certificate Authority

I'm trying to setup a Keycloak server on Unraid in my home network. I have a home certificate authority that provides certificates for all of my internal services. Im trying to setup a Keycloak server and use it for SSO with Unraid. I've followed the guide here: https://docs.unraid.net/API/oidc-provider-setup/#keycloak but once I put keycloak behind SSL I wasn't able to get Unraid API to connect anymore. I get the following error:

[11:58:13 ERROR OidcTokenExchangeService]:   [Cause 1] Error: unable to get local issuer certificate {"apiVersion":"4.34.0+a2d48433","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[11:58:13 ERROR OidcTokenExchangeService]:   [Cause 1] Code: UNABLE_TO_GET_ISSUER_CERT_LOCALLY {"apiVersion":"4.34.0+a2d48433","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[11:58:13 DEBUG OidcTokenExchangeService]: Stack trace: TypeError: fetch failed
    at async OidcTokenExchangeService.exchangeCodeForTokens (file:///usr/local/unraid-api/dist/assets/plugin.module-Bu4zPTJU.js:27841:28)
    at async OidcService.handleCallback (file:///usr/local/unraid-api/dist/assets/plugin.module-Bu4zPTJU.js:28626:28)
    at async OidcRequestHandler.handleCallback (file:///usr/local/unraid-api/dist/assets/app.module-D2-vdlzz.js:708:29)
    at async RestController.oidcCallback (file:///usr/local/unraid-api/dist/assets/app.module-D2-vdlzz.js:946:22) {"apiVersion":"4.34.0+a2d48433","logger":"OidcTokenExchangeService","context":"OidcTokenExchangeService"}
[11:58:13 ERROR OidcService]: OAuth callback error: fetch failed {"apiVersion":"4.34.0+a2d48433","logger":"OidcService","context":"OidcService"}

I add my root certificate to the trusted cert store in /usr/local/share/ca-certificates/ and then run update-ca-certificates but this doesn't seem to persist after a restart so I'm not sure if I'm not configuring that correctly or missing something. Even after restarting the API after getting the certificate trusted it doesn't work. The Unraid web GUI is also running under a certificate provided by the local authority

I've also connected one of my other docker containers to Keycloak already and the SSO works there. That container is also using a certificate signed by the CA via a reverse proxy so it appears that Keycloak trusts that root.

I'm not sure what I can do to see what is rejecting the connection, how to permanently trust the certificate or how to disable the verification check.

Edited May 25May 25 by mato9020