1.Create JKS file and generate self signed certificate
keytool -genkey -alias jboss -keysize 2048 -validity 365 -keyalg RSA -sigalg SHA256withRSA -keystore jboss.jks -storepass jboss@123 -keypass jboss@123 -dname “CN=example.com, OU=blog, O=AskMiddlewareExpert.com, C=IN”
Configure a keystore
/host=master/subsystem=elytron/key-store=httpsKS:add(path=”${jboss.home.dir}/ssl/jboss.jks”, credential-reference={clear-text=jboss@123}, type=JKS)
2.Connect JBOSS Cli mode to configure keystore, key-manager and ssl-context in Elytron
Create a new key-manager
/host=master/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=”SunX509″,credential-reference={clear-text=jboss@123})
Configure new server-ssl-context reference with protocol and ciphers
/host=master/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=[“TLSv1.2″], cipher-suite-filter=”TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA”)
Run the above 3 CLI commands to make changes within profile eg. full-ha in domain.xml as below:
/profile=full-ha/subsystem=elytron/key-store=httpsKS:add(path=”/home/sshriram/EAP7.1/7.1/LDAP/jboss-eap-7.1/domain/configuration/jboss.jks”, credential-reference={clear-text=jboss@123}, type=JKS)
/profile=full-ha/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=”SunX509″,credential-reference={clear-text=jboss@123})
/profile=full-ha/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=[“TLSv1.2″], cipher-suite-filter=”TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA”)
3.Configure undertow to map ssl-context of Elytron
[domain@localhost:9990 /] batch
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=httpsSSC)
[domain@localhost:9990 / #] run-batch
4) If you want management-interface to use the same ssl-context, execute the following command which will enable SSL in management-interface
[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=ssl-context, value=httpsSSC)
[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=secure-port,value=8443)
Reload the servers to make the change effective.
reload –host=master
5.Restart Jboss and verify https url’s reflected with the self-signed certificate that we generated .
We can also enable SSL in the traditional way . And the content of xml file loos like below .standalone.xml
(or host.xml
for domain)
<security-realms> <security-realm name="CertificateRealm"> <server-identities> <ssl> <keystore path="/path/to/keystore.jks" keystore-password="secret" alias="servercert"/> </ssl> </server-identities> <authentication> <truststore path="/path/to/truststore.jks" keystore-password="secret"/> </authentication> </security-realm> </security-realms>
<subsystem xmlns="urn:jboss:domain:undertow:3.1">
<buffer-cache name="default"/>
<server name="default-server">
<http-listener name="default" socket-binding="http" redirect-socket="https"/>
<https-listener name="https" secure="true" enabled-protocols="TLSv1.1,TLSv1.2" security-realm="CertificateRealm" socket-binding="https"/>
...
Under profile undertow CertificateRealm will be mappted to https https-listener.
https name is refered in the port interface .