SSL Setup Jboss EAP 7.X Elythron

1.Create JKS file and generate self signed certificate
keytool -genkey -alias jboss -keysize 2048 -validity 365 -keyalg RSA -sigalg SHA256withRSA -keystore jboss.jks -storepass jboss@123 -keypass jboss@123 -dname “CN=example.com, OU=blog, O=AskMiddlewareExpert.com, C=IN”

Configure a keystore

/host=master/subsystem=elytron/key-store=httpsKS:add(path=”${jboss.home.dir}/ssl/jboss.jks”, credential-reference={clear-text=jboss@123}, type=JKS)
2.Connect JBOSS Cli mode to configure keystore, key-manager and ssl-context in Elytron

Create a new key-manager

/host=master/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=”SunX509″,credential-reference={clear-text=jboss@123})

Configure new server-ssl-context reference with protocol and ciphers

/host=master/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=[“TLSv1.2″], cipher-suite-filter=”TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA”)

Run the above 3 CLI commands to make changes within profile eg. full-ha in domain.xml as below:

/profile=full-ha/subsystem=elytron/key-store=httpsKS:add(path=”/home/sshriram/EAP7.1/7.1/LDAP/jboss-eap-7.1/domain/configuration/jboss.jks”, credential-reference={clear-text=jboss@123}, type=JKS)

/profile=full-ha/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm=”SunX509″,credential-reference={clear-text=jboss@123})

/profile=full-ha/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=[“TLSv1.2″], cipher-suite-filter=”TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA”)

3.Configure undertow to map ssl-context of Elytron

[domain@localhost:9990 /] batch
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
[domain@localhost:9990 / #] /profile=full-ha/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=httpsSSC)
[domain@localhost:9990 / #] run-batch

4) If you want management-interface to use the same ssl-context, execute the following command which will enable SSL in management-interface

[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=ssl-context, value=httpsSSC)
[domain@localhost:9990 /] /host=master/core-service=management/management-interface=http-interface:write-attribute(name=secure-port,value=8443)

Reload the servers to make the change effective.

reload –host=master

5.Restart Jboss and verify https url’s reflected with the self-signed certificate that we generated .

We can also enable SSL in the traditional way . And the content of xml file loos like below .standalone.xml (or host.xml for domain) 

<security-realms>
    <security-realm name="CertificateRealm">
        <server-identities>
            <ssl>
                <keystore path="/path/to/keystore.jks" keystore-password="secret" alias="servercert"/>
            </ssl>
        </server-identities>
        <authentication>
            <truststore path="/path/to/truststore.jks" keystore-password="secret"/>
        </authentication>
    </security-realm>
</security-realms>
<subsystem xmlns="urn:jboss:domain:undertow:3.1">
    <buffer-cache name="default"/>
    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https"/>
        <https-listener name="https" secure="true" enabled-protocols="TLSv1.1,TLSv1.2" security-realm="CertificateRealm" socket-binding="https"/>
...

Under profile undertow CertificateRealm will be mappted to https https-listener.

https name is refered in the port interface .

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *