2.5. 为旧的核心管理验证机制配置 SSL 或 TLS

流程

1. 将主域控制器配置为使用 SSL 或 TLS，如以下示例中所示。当您配置了所有证书和密钥存储后，您需要配置安全域以使用双向 SSL/TLS。您可以通过将安全域配置为使用 SSL/TLS 来达到此目的。配置的安全域将保护用于在主机控制器和主域控制器之间连接的管理接口。

   注意

   在批处理模式或服务器上运行以下命令。在添加 ssl 服务器身份后，您必须重新加载服务器。此流程中的示例以批处理模式运行。

   batch
   
   /host=master/core-service=management/security-realm=CertificateRealm:add()
   
   /host=master/core-service=management/security-realm=CertificateRealm/server-identity=ssl:add(alias=domaincontroller,keystore-relative-to=jboss.domain.config.dir,keystore-path=domaincontroller.jks,keystore-password=secret)
   
   /host=master/core-service=management/security-realm=CertificateRealm/authentication=truststore:add(keystore-relative-to=jboss.domain.config.dir,keystore-path=domaincontroller.jks,keystore-password=secret)
   
   /host=master/core-service=management/security-realm=CertificateRealm/authentication=local:add(default-user=\$local)
   
   /host=master/core-service=management/security-realm=CertificateRealm/authentication=properties:add(relative-to=jboss.domain.config.dir,path=mgmt-users.properties)
   
   /host=master/core-service=management/management-interface=http-interface:write-attribute(name=security-realm,value=CertificateRealm)
   
   run-batch

2. 将所有主机控制器配置为使用 SSL 或 TLS，如下例所示：

   batch
   
   /host=instance1/core-service=management/security-realm=CertificateRealm:add()
   
   /host=instance1/core-service=management/security-realm=CertificateRealm/server-identity=ssl:add(alias=instance1,keystore-relative-to=jboss.domain.config.dir,keystore-path=instance1.jks,keystore-password=secret)
   
   /host=instance1/core-service=management/security-realm=CertificateRealm/authentication=truststore:add(keystore-relative-to=jboss.domain.config.dir,keystore-path=instance1.jks,keystore-password=secret)
   
   /host=instance1/core-service=management/security-realm=CertificateRealm/authentication=local:add(default-user="\$local")
   
   /host=instance1/core-service=management/security-realm=CertificateRealm/authentication=properties:add(relative-to=jboss.domain.config.dir,path=mgmt-users.properties)
   
   /host=instance1/core-service=management/management-interface=http-interface:write-attribute(name=security-realm,value=CertificateRealm)
   
   run-batch

3. 更新连接主域控制器时使用的安全域。当服务器没有运行时，您必须对主机控制器配置文件进行这个更新。例如，host.xml 或 host-slave.xml。

   <domain-controller>
     <remote security-realm="CertificateRealm" username="slave-user">
       <discovery-options>
         <static-discovery name="primary" protocol="${jboss.domain.master.protocol:remote}" host="${jboss.domain.master.address}" port="${jboss.domain.master.port:9990}"/>
       </discovery-options>
     </remote>
   </domain-controller>