5.9. Using 2-way SSL for the Management interface and the CLI

Procedure 5.3. 

1. Generate the stores:
   Copy to Clipboard Toggle word wrap

   keytool -genkeypair -alias HOST1_alias -keyalg RSA -keysize 1024 -validity 365 -keystore host1.keystore.jks -dname "CA_HOST1" -keypass secret -storepass secret

   Copy to Clipboard Toggle word wrap

   keytool -genkeypair -alias HOST2_alias -keyalg RSA -keysize 1024 -validity 365 -keystore host2.keystore.jks -dname "CA_HOST2" -keypass secret -storepass secret

2. Export the certificates:
   Copy to Clipboard Toggle word wrap

   keytool -exportcert  -keystore HOST1.keystore.jks -alias HOST1_alias -keypass secret -storepass secret -file HOST1.cer
   

   Copy to Clipboard Toggle word wrap

   keytool -exportcert  -keystore HOST2.keystore.jks -alias HOST2_alias -keypass secret -storepass secret -file HOST2.cer
   

3. Import the certificates into the opposing trust stores:
   Copy to Clipboard Toggle word wrap

   keytool -importcert -keystore HOST1.truststore.jks -storepass secret -alias HOST2_alias -trustcacerts -file HOST2.cer
   

   Copy to Clipboard Toggle word wrap

   keytool -importcert -keystore HOST2.truststore.jks -storepass secret -alias HOST1_alias -trustcacerts -file HOST1.cer
   

4. Define a CertificateRealm in the configuration for your installation (host.xml or standalone.xml) and point the interface to it:
   This can be done by manually editing the configuration file (not recommended) or by using the following commands:
   Copy to Clipboard Toggle word wrap

   /core-service=management/security-realm=CertificateRealm:add()

   Copy to Clipboard Toggle word wrap

   /core-service=management/security-realm=CertificateRealm/server-identity=ssl:add(keystore-path=/path/to/HOST1.keystore.jks,keystore-password=secret, alias=HOST1_alias)

   Copy to Clipboard Toggle word wrap

   /core-service=management/security-realm=CertificateRealm/authentication=truststore:add(keystore-path=/path/to/HOST1.truststore.jks,keystore-password=secret)

   Important

   The provided commands apply to standalone mode only. For domain mode, add /host=master before each command.
5. Change the security-realm of the native-interface to the new Certificate Realm.
   Copy to Clipboard Toggle word wrap

   /host=master/core-service=management/management-interface=native-interface:write-attribute(name=security-realm,value=CertificateRealm)

6. Add the SSL configuration for the CLI, which uses EAP_HOME/bin/jboss-cli.xml as a settings file. Either use a password vault to store the keystore and truststore passwords (recommended), or store them in plain text:
   • To store the keystore and truststore passwords in a password vault:
     Edit EAP_HOME/bin/jboss-cli.xml and add the SSL configuration (using the appropriate values for the variables). Also add the vault configuration, replacing each value with those of your vault.
     Copy to Clipboard Toggle word wrap

     <ssl>
       <vault>
         <vault-option name="KEYSTORE_URL" value="path-to/vault/vault.keystore"/>
         <vault-option name="KEYSTORE_PASSWORD" value="MASK-5WNXs8oEbrs"/>
         <vault-option name="KEYSTORE_ALIAS" value="vault"/>
         <vault-option name="SALT" value="12345678"/>
         <vault-option name="ITERATION_COUNT" value="50"/>
         <vault-option name="ENC_FILE_DIR" value="path-to/jboss-eap/vault/"/>
       </vault>
       <alias>$HOST2alias</alias>
       <key-store>/path/to/HOST2.keystore.jks</key-store>
       <key-store-password>VAULT::VB::cli_pass::1</key-store-password>
       <key-password>VAULT::VB::cli_pass::1</key-password>  
       <trust-store>/path/to/HOST2.truststore.jks</trust-store>
       <trust-store-password>VAULT::VB::cli_pass::1</trust-store-password>
       <modify-trust-store>true</modify-trust-store>
     </ssl>

   • To store the keystore and truststore passwords in plain text:
     Edit EAP_HOME/bin/jboss-cli.xml and add the SSL configuration (using the appropriate values for the variables):
     Copy to Clipboard Toggle word wrap

     <ssl>
       <alias>$HOST2alias</alias>
       <key-store>/path/to/HOST2.keystore.jks</key-store>
       <key-store-password>secret</key-store-password>
       <trust-store>/path/to/HOST2.truststore.jks</trust-store>
       <trust-store-password>secret</trust-store-password>
       <modify-trust-store>true</modify-trust-store>
     </ssl>