Enabling SSL on JBoss

[James Dekker]

How can I enable SSL on JBoss 5 on a Linux (Red Hat - Fedora 8) box?

What I've done so far is:

(1) Create a test keystore by doing this and then answering all the questions.

(2) Placed the newly generated server.keystore in $JBOSS_HOME/server/default/conf

(3) Make the following change in the server.xml in $JBOSS_HOME/server/default/deploy/jbossweb.sar to include this:

<!-- SSL/TLS Connector configuration using the admin devl guide keystore -->
     <Connector protocol="HTTP/1.1" SSLEnabled="true"
          port="8443" address="${jboss.bind.address}"
          scheme="https" secure="true" clientAuth="false"
          keystoreFile="${jboss.server.home.dir}/server/default/conf/server.keystore"
          keystorePass="mypassword" sslProtocol = "TLS" />

What more do I need to do to enable full SSL client authentication?

A lot of the web sites on Google state how to enable SSL for JBoss 3 - 4. I need a good tutorial for JBoss 5.

Happy programming,

James

[Jaikiran Pai]

See this http://www.coderanch.com/t/452227/JBoss/enable-https-jboss

Also, this looks incorrect in your configuration:

keystoreFile="${jboss.server.home.dir}/server/default/conf/server.keystore" 

jboss.server.home.dir points to $JBOSS_HOME/server/default (assuming you are starting the default configuration) folder. So that property should be set to:

keystoreFile="${jboss.server.home.dir}/conf/server.keystore"  

A lot of the web sites on Google state how to enable SSL for JBoss 3 - 4. I need a good tutorial for JBoss 5.

JBoss AS 5 documentation is scattered across various wiki and forum posts. You can search these places or you can buy the JBoss In Action book by Peter Johnson which concentrates on various configurations in JBoss AS 5.

[James Dekker]

Thank you for all of your help...

Actually, I already did change that to (in $JBOSS_HOME/server/default/deploy/jbossweb.sar/server.xml):

<!-- SSL/TLS Connector configuration using the admin devl guide keystore -->
      <Connector protocol="HTTP/1.1" SSLEnabled="true"
           port="8443" address="${jboss.bind.address}"
           scheme="https" secure="true" clientAuth="false"
           keystoreFile="${jboss.server.home.dir}/conf/server.keystore"
           keystorePass="mypassword" sslProtocol = "TLS" />

The problem now is that when JBoss starts it logs this exception (during start-up) (but I am still able to view everything under http://localhost:8080/):

03:59:54,780 ERROR [Http11Protocol] Error initializing endpoint
java.io.IOException: Cannot recover key
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:456)
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:139)
	at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:498)
	at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:175)
	at org.apache.catalina.connector.Connector.initialize(Connector.java:1029)
	at org.apache.catalina.core.StandardService.initialize(StandardService.java:683)
	at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:821)
	at org.jboss.web.tomcat.service.deployers.TomcatService.startService(TomcatService.java:313)

I do know that's there's more to be done to enable full SSL client authentication....