Breadcrumbs

Configuring TLS and HTTP

The port 8080 is used for a regular HTTP traffic, the port 8442 for HTTPS with server authentication and the port 8443 for HTTPS with both client and server authentication.

  1. Start JBoss with the CLI command:

›_ Console 

# APPSRV_HOME/bin/jboss-cli.sh -c

  1. To remove any existing TLS and HTTP configuration and enable configuration of the port 8443, run the following commands:

›_ Console 

# /subsystem=undertow/server=default-server/http-listener=default:remove  
# /subsystem=undertow/server=default-server/https-listener=https:remove  
# /socket-binding-group=standard-sockets/socket-binding=http:remove  
# /socket-binding-group=standard-sockets/socket-binding=https:remove # :reload

  1. Configure interfaces by using the appropriate bind-address: e.g. this example uses bindaddress to makeaccess available for anyone:

›_ Console 

# /interface=http:add(inet-address="0.0.0.0") 

# /interface=httpspub:add(inet-address="0.0.0.0") 

# /interface=httpspriv:add(inet-address="0.0.0.0")

Note that WildFlys default size for an HTTP post size limit is 10 MB. To allow signing larger files, increase the limits on the HTTP/HTTPS listeners by using the max-post-size attribute in the following code examples.

For Wildfly 10: If a larger limit than the default value of 10 MB is specified for the HTTPS listeners, check that the max-post-size value is updated in the standalone.xml file after running the CLI command. If the value was not updated in the XML file, stop the application server and update the max-post-size value in the standalone.xml file manually, before starting the application server again.

  1. Configure the HTTPS httpspriv listener and set up a private port, that requires a client certificate. Use the appropriate values for the key-alias (hostname), password (keystore password), ca-certificate-password (trust store password) and the supported protocols.

Use the enable-http2="false" to avoid error messages in the log.

›_ Console 

# /core-service=management/security-realm=SSLRealm:add() 

#/core-service=management/security-realm=SSLRealm/server-identity=ssl:add(keystorepath="keystore/keystore.jks", keystore-relative-to="jboss.server.config.dir", keystorepassword="serverpwd", alias="localhost") 
:reload  
#/core-service=management/security-realm=SSLRealm/authentication=truststore:add(keystore
path="keystore/truststore.jks", keystore-relative-to="jboss.server.config.dir", keystore
password="changeit")  
:reload  
#/socket-binding-group=standard-sockets/socket-binding=httpspriv:add(port="8443",interface="httpspriv")  
#/subsystem=undertow/server=default-server/https-listener=httpspriv:add(socket-binding="httpspriv",   
security-realm="SSLRealm", verify-client=REQUIRED, max-post-size="10485760", enable-http2="true")

  1. Configure the default HTTP listener:

›_ Console 

# /socket-binding-group=standard-sockets/socket-binding=http:add(port="8080",interface="http") 

#/subsystem=undertow/server=default-server/http-listener=default:add(socket-binding=http, max-postsize="10485760", enable-http2="true") 

#/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket, value="httpspriv") 

:reload

  1. Configure the HTTPS httpspub listener and set up the public SSL port that does not require a client certificate:

›_ Console 

# /socket-binding-group=standard-sockets/socket-binding=httpspub:add(port="8442",interface="httpspub") 

# /subsystem=undertow/server=default-server/https-listener=httpspub:add(socket-binding="httpspub", security-realm="SSLRealm", max-post-size="10485760", enable-http2="true") # :reload

  1. Configure the remoting HTTP listener and secure the CLI by preventing the HTTP-remotingconnector from using the HTTP port and use a separate port 4447 instead:

›_ Console 

# /subsystem=remoting/http-connector=http-remoting-connector:remove 

#/subsystem=remoting/http-connector=http-remoting-connector:add(connector-ref="remoting",securityrealm="ApplicationRealm") 

#/socket-binding-group=standard-sockets/socket-binding=remoting:add(port="4447") 
#/subsystem=undertow/server=default-server/http-listener=remoting:add(socket-binding=remoting, maxpost-size="10485760", enable-http2="true")