DevOps should configure SSL support on WildFly application servers for security reasons. The following steps describe how to configure HTTPS on local server for the web application:
Step 1:
Generate a keystore and self-signed certificate
Ensure that Java is installed and setup on JAVA_HOME
properly as JRE keytool will be used for this purpose.
Switch to a command-line and execute the following command as shown below:
$ keytool -genkey -alias mycert -keyalg RSA -keystore mycert.keystore -validity 365
The aforementioned command has some default sets, and also prompts the developer to enter additional information as shown below:
What is your first and last name?
[Unknown]: Orestis Pantazos
What is the name of your organizational unit?
[Unknown]: Open DevOps
What is the name of your organization?
[Unknown]: opendevops.dev
What is the name of your City or Locality?
[Unknown]: Athens
What is the name of your State or Province?
[Unknown]: Greece
What is the two-letter country code for this unit?
[Unknown]: GR
Is CN=Orestis Pantazos, OU=Open DevOps, O=opendevops.dev, L=Athens, ST=Greece, C=GR correct?
[no]: yes
Step 2:
The command generates mycert.keystore file in the folder that you are currently working. Copy this to your WildFly config directory (%JBOSS_HOME%/standalone/config
)
Step 3:
Configure the additional WildFly Security Realm
The next step is to configure the new keystore as a server identity for SSL in the WildFly security-realms section of the standalone.xml
. You can insert the source code after <management>
tag and also inside <security-realms>
tag in the XML file.
<management>
<security-realms>
<security-realm name="UndertowRealm">
<server-identities>
<ssl>
<keystore path="mycert.keystore" relative-to="jboss.server.config.dir" keystore-password="secret" alias="mycert" key-password="secret"/>
</ssl>
</server-identities>
</security-realm>
Step 4:
Configure Undertow Subsystem for SSL
If the default-server is running, add the https-listener to the undertow subsystem:
<subsystem xmlns="urn:jboss:domain:undertow:1.2">
<server name="default-server">
<https-listener name="https" socket-binding="https" security-realm="UndertowRealm"/>
Replace only the word UndertowRealm
with the previous one for https listener in the given namespace into security-realm="..."
.
Step 5:
SSL port of the current instance is already for connection in https://localhost:8443/
. Otherwise, the SSL port can be changed to 443 as default port number in the end/bottom of the file.
Top comments (0)