2.4. 使用 Elytron 在域模式中配置 SSL

流程

1. 创建自签名证书以启用 SSL：

   keytool -genkey -alias jboss -keysize 2048 -validity 365 -keyalg RSA -sigalg SHA256withRSA -keystore jboss.jks -storepass jboss@123 -keypass jboss@123 -dname "CN=example.com, OU=JavaEE, O=Red Hat, C=IN"

   Copy to Clipboard Toggle word wrap

2. 使用管理 CLI 创建密钥存储、key-manager 和 ssl-context。

   #Configure a keystore
   /profile=<profile-name>/subsystem=elytron/key-store=httpsKS:add(path="${jboss.home.dir}/ssl/jboss.jks", credential-reference={clear-text=jboss@123}, type=JKS)
   
   #Create a new key-manager
   /profile=<profile-name>/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm="SunX509",credential-reference={clear-text=jboss@123})
   
   #Configure new server-ssl-context reference with protocol and ciphers
   /profile=<profile-name>/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=["TLSv1.2"])

   Copy to Clipboard Toggle word wrap

3. 配置 undertow 子系统，以映射 Elytron ssl-context ：

   batch
   /profile=<profile-name>/subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm)
   /profile=<profile-name>/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=httpsSSC)
   run-batch

   Copy to Clipboard Toggle word wrap

4. 可选： 保护 management-interface 以使用同一 ssl-context ：

   host-*.xml 文件定义域控制器和主机控制器的配置，该配置包含管理接口。要确保 SSL 配置成功，您必须在主机上再次定义 ssl-context。

   #Configure a keystore on the master DC host
   /host=<host-name>/subsystem=elytron/key-store=httpsKS:add(path="${jboss.home.dir}/ssl/jboss.jks", credential-reference={clear-text=jboss@123}, type=JKS)
   
   #Create a new key-manager on the master DC host
   /host=<host-name>/subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,algorithm="SunX509",credential-reference={clear-text=jboss@123})
   
   #Configure new server-ssl-context reference with protocol and ciphers on the master DC host
   /host=<host-name>/subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=["TLSv1.2"])
   
   #Configure the secure-port and ssl-context for management-http interface  on the master DC host
   /host=<host-name>/core-service=management/management-interface=http-interface:write-attribute(name=ssl-context,value=httpsSSC)
   
   /host=<host-name>/core-service=management/management-interface=http-interface:write-attribute(name=secure-port,value=9993)

   Copy to Clipboard Toggle word wrap
5. 确保正确配置了信任存储，使远程主机控制器能够通过 SSL 连接到域控制器。如需更多信息，请参阅使用 Elytron 配置域和主机控制器之间的 SSL/TLS。

6. 重新载入服务器以确保更改有效：

   reload --host=<host-name>

   Copy to Clipboard Toggle word wrap