Over a million developers have joined DZone.

Securing JBoss EAP 6 - Implementing SSL

DZone's Guide to

Securing JBoss EAP 6 - Implementing SSL

· DevOps Zone ·
Free Resource

Is the concept of adopting a continuous everything model a daunting task for your fast moving business? Read this whitepaper to break down and understand one of the key pillars of this model in Continuous Governance: The Guardrails for Continuous Everything.

Security is one of the most important features while running a JBoss server in a production environment. Implementing SSL and securing communications is a must do, to avoid malicious use.

This blogs details the steps you could take to secure JBoss EAP 6 running in Domain mode. These are probably documented by RedHat but the documentation seems a bit scattered. The idea behind this blog is to put together everything in one place.

In Order to enhance security in JBoss EAP 6, SSL/encryption can be implemented for the following

  • Admin console access – enable https access for admin console
  • Domain Controller – Host controller communication – Communication between the main domain controller and all the other host controllers should be secured.
  • Jboss CLI – enable ssl for the command line interface

The below example uses a single keystore being both the key and truststore and also uses CA signed certificates. 

You could use self-signed certificates and/or separated keystores and truststores if required.

  1. Create the keystores (certificates for each of the servers)
      • keytool -genkeypair -alias testServer.prd -keyalg RSA -keysize 2048 -validity 730 -keystore testServer.prd.jks
  2. Generate a certificate signing request (CSR) for the Java keystore
      • keytool -certreq -alias testServer.prd -keystore testServer.prd.jks -file testServer.prd.csr
  3. Get the CSR signed by the Certificate Authorities
  4.  Import a root or intermediate CA certificate to the existing Java keystore
      • keytool -import -trustcacerts -alias root -file rootCA.crt -keystore testServer.prd.jks
  5. Import the signed primary certificate to the existing Java keystore.
      • Keytool -importcert -keystore testServer.prd.jks -trustcacerts -alias testServer.prd -file testServer.prd.crt
  6. Repeat steps 1-6 for each of the servers.

In order to establish trust between the master and slave hosts,

  1. Import the signed certificates of all the (slave) servers that the Domain Controller must trust onto the Domain Controllers Keystore
      • keytool -importcert -keystore testServer.prd.jks  -trustcacerts -alias slaveServer.prd -file slaveServers.prd.crt
      •  repeat step for all slave hosts.
  2. Import the signed certificate of the Domain controller onto the slave hosts
      •  keytool -importcert -keystore slaveServer.prd.jks  -trustcacerts -alias testServer.prd -file testServer.prd.crt
      • repeat steps for all slave hosts

This has be to done because (as per RedHat’s Documentation)

There is a problem with this methodology when trying to configure one way SSL between the servers, because there the HC's and the DC (depending on what action is being performed) switch roles (client, server). Because of this one way SSL configuration will not work and it is recommended that if you need SSL between these two endpoints that you configure two way SSL

Once this is done, we now have signed certificates loaded onto the java keystore.

In Jboss EAP 6 , the http-interface which provides access to the admin console, by default uses the ManagementRealm to provide file based authentication. (mgmt.-users.properties).The next step is to modify the configurations in the host.xml, to make the ManagementRealm use the certificates we created above.

The host.xml should be modified to look like:

01. <management>
03.         <security-realms>
05.             <security-realm name="ManagementRealm">
07.                 <server-identities>
09.                     <ssl protocol="TLSv1">
11.                          <keystore path="testServer.prd.jks" relative-to="jboss.domain.config.dir" keystore-password="xxxx" alias="testServer.prd"/>
13.                     </ssl>
15.                 </server-identities>
17.                 <authentication>
19.                     <truststore path="testServer.prd.jks" relative-to="jboss.domain.config.dir" keystore-password="xxxx"/>
21.                     <local default-user="$local"/>
23.                     <properties path="mgmt-users.properties" relative-to="jboss.domain.config.dir"/>
25.                 </authentication>
27.             </security-realm>
29. <management-interfaces>
31.             <native-interface security-realm="ManagementRealm">
33.                 <socket interface="management" port="${jboss.management.native.port:9999}"/>
35.             </native-interface>
37.             <http-interface security-realm="ManagementRealm">
39.                 <socket interface="management" secure-port="9443"/>
41.             </http-interface>
43.         </management-interfaces>

On the Slave hosts, In addition to the above configuration, the following needs to be changed

1. <domain-controller>
3.    <remote host="testServer" port="${jboss.domain.master.port:9999}" security-realm="ManagementRealm"/>"
5. </domain-controller>

Once you make the above changes and restart the servers, you should be able to access the admin console via https.


Finally, in order to secure cli authentication

 Modify /opt/jboss/jboss-eap-6.1/bin/jboss-cli.xml for each server and add

01. <ssl>
03.        <alias>testServer.prd</alias>
05.        <key-store>/opt/jboss/jboss-eap-6.1/domain/configuration/testServer.prd.jks</key-store>
07.        <key-store-password>xxxx </key-store-password>
09.        <trust-store>/opt/jboss/jboss-eap-6.1/domain/configuration/testServer.prd.jks</trust-store>
11.        <trust-store-password>xxxx </trust-store-password>
13.        <modify-trust-store>true</modify-trust-store>
15.     </ssl>

Are you looking for greater insight into your software development value stream? Check out this whitepaper: DevOps Performance: The Importance of Measuring Throughput and Stability to see how CloudBees DevOptics can give you the visibility to improve your continuous delivery process.


Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}