Search

5.9. Using 2-way SSL for the Management interface and the CLI

download PDF
2-way SSL authentication, also known as client authentication, authenticates both the client and the server using SSL certificates. This provides assurance that not only is the server who it says it is, but the client is also who it says it is.
In this topic the following conventions are used:

HOST1
The JBoss server hostname. For example; jboss.redhat.com
HOST2
A suitable name for the client. For example: myclient. Note this is not necessarily an actual hostname.
CA_HOST1
The DN (distinguished name) to use for the HOST1 certificate. For example cn=jboss,dc=redhat,dc=com.
CA_HOST2
The DN (distinguished name) to use for the HOST2 certificate. For example cn=myclient,dc=redhat,dc=com.

Prerequisites

Procedure 5.3. 

  1. Generate the stores:
    keytool -genkeypair -alias HOST1_alias -keyalg RSA -keysize 1024 -validity 365 -keystore host1.keystore.jks -dname "CA_HOST1" -keypass secret -storepass secret
    keytool -genkeypair -alias HOST2_alias -keyalg RSA -keysize 1024 -validity 365 -keystore host2.keystore.jks -dname "CA_HOST2" -keypass secret -storepass secret
  2. Export the certificates:
    keytool -exportcert  -keystore HOST1.keystore.jks -alias HOST1_alias -keypass secret -storepass secret -file HOST1.cer
    
    keytool -exportcert  -keystore HOST2.keystore.jks -alias HOST2_alias -keypass secret -storepass secret -file HOST2.cer
    
  3. Import the certificates into the opposing trust stores:
    keytool -importcert -keystore HOST1.truststore.jks -storepass secret -alias HOST2_alias -trustcacerts -file HOST2.cer
    
    keytool -importcert -keystore HOST2.truststore.jks -storepass secret -alias HOST1_alias -trustcacerts -file HOST1.cer
    
  4. Define a CertificateRealm in the configuration for your installation (host.xml or standalone.xml) and point the interface to it:
    This can be done by manually editing the configuration file (not recommended) or by using the following commands:
    /core-service=management/security-realm=CertificateRealm:add()
    /core-service=management/security-realm=CertificateRealm/server-identity=ssl:add(keystore-path=/path/to/HOST1.keystore.jks,keystore-password=secret, alias=HOST1_alias)
    /core-service=management/security-realm=CertificateRealm/authentication=truststore:add(keystore-path=/path/to/HOST1.truststore.jks,keystore-password=secret)

    Important

    The provided commands apply to standalone mode only. For domain mode, add /host=master before each command.
  5. Change the security-realm of the native-interface to the new Certificate Realm.
    /host=master/core-service=management/management-interface=native-interface:write-attribute(name=security-realm,value=CertificateRealm)
  6. Add the SSL configuration for the CLI, which uses EAP_HOME/bin/jboss-cli.xml as a settings file. Either use a password vault to store the keystore and truststore passwords (recommended), or store them in plain text:
    • To store the keystore and truststore passwords in a password vault:
      Edit EAP_HOME/bin/jboss-cli.xml and add the SSL configuration (using the appropriate values for the variables). Also add the vault configuration, replacing each value with those of your vault.
      <ssl>
        <vault>
          <vault-option name="KEYSTORE_URL" value="path-to/vault/vault.keystore"/>
          <vault-option name="KEYSTORE_PASSWORD" value="MASK-5WNXs8oEbrs"/>
          <vault-option name="KEYSTORE_ALIAS" value="vault"/>
          <vault-option name="SALT" value="12345678"/>
          <vault-option name="ITERATION_COUNT" value="50"/>
          <vault-option name="ENC_FILE_DIR" value="path-to/jboss-eap/vault/"/>
        </vault>
        <alias>$HOST2alias</alias>
        <key-store>/path/to/HOST2.keystore.jks</key-store>
        <key-store-password>VAULT::VB::cli_pass::1</key-store-password>
        <key-password>VAULT::VB::cli_pass::1</key-password>  
        <trust-store>/path/to/HOST2.truststore.jks</trust-store>
        <trust-store-password>VAULT::VB::cli_pass::1</trust-store-password>
        <modify-trust-store>true</modify-trust-store>
      </ssl>
    • To store the keystore and truststore passwords in plain text:
      Edit EAP_HOME/bin/jboss-cli.xml and add the SSL configuration (using the appropriate values for the variables):
      <ssl>
        <alias>$HOST2alias</alias>
        <key-store>/path/to/HOST2.keystore.jks</key-store>
        <key-store-password>secret</key-store-password>
        <trust-store>/path/to/HOST2.truststore.jks</trust-store>
        <trust-store-password>secret</trust-store-password>
        <modify-trust-store>true</modify-trust-store>
      </ssl>
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.