Unzip EAP zip archive and start via ./bin/standalone.sh Prepare keys, keystores and truststores: keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore server.keystore.jks -dname "CN=localhost" -keypass secret -storepass secret keytool -genkeypair -alias client -keyalg RSA -keysize 1024 -validity 365 -keystore client.keystore.jks -dname "CN=client" -keypass secret -storepass secret keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore bad.jks -dname "CN=localhost" -keypass secret -storepass secret keytool -exportcert -keystore server.keystore.jks -alias localhost -keypass secret -storepass secret -file server.cer keytool -exportcert -keystore client.keystore.jks -alias client -keypass secret -storepass secret -file client.cer keytool -importcert -noprompt -keystore server.truststore.jks -storepass secret -alias client -trustcacerts -file client.cer keytool -importcert -noprompt -keystore client.truststore.jks -storepass secret -alias localhost -trustcacerts -file server.cer keytool -importkeystore -srckeystore client.keystore.jks -destkeystore client.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass secret -destkeypass secret -srcalias client -destalias client -srcstorepass secret keytool -importkeystore -srckeystore server.keystore.jks -destkeystore server.p12 -srcstoretype JKS -deststoretype PKCS12 -deststorepass secret -destkeypass secret -srcalias localhost -destalias localhost -srcstorepass secret Configure server-side SSL /subsystem=elytron/key-store=twoWayKSserver:add(path=server.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-store=twoWayTSserver:add(path=server.truststore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-manager=twoWayKMserver:add(key-store=twoWayKSserver,algorithm= "SunX509" ,credential-reference={clear-text=secret}) /subsystem=elytron/trust-manager=twoWayTMserver:add(key-store=twoWayTSserver,algorithm= "SunX509" ) /subsystem=elytron/server-ssl-context=twoWaySSCserver:add(providers=openssl,key-manager=twoWayKMserver,protocols=[ "TLSv1.2" ],trust-manager=twoWayTMserver,need-client-auth= true ) batch /subsystem=undertow/server= default -server/https-listener=https:undefine-attribute(name=security-realm) /subsystem=undertow/server= default -server/https-listener=https:write-attribute(name=ssl-context,value=twoWaySSCserver) run-batch Prepare client-side SSL: /subsystem=elytron/key-store=twoWayKSclient:add(path=client.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-store=twoWayTSclient:add(path=client.truststore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-manager=twoWayKMclient:add(key-store=twoWayKSclient,algorithm= "SunX509" ,credential-reference={clear-text=secret}) /subsystem=elytron/trust-manager=twoWayTMclient:add(key-store=twoWayTSclient,algorithm= "SunX509" ) /subsystem=elytron/client-ssl-context=twoWaySSCclient:add(providers=openssl,key-manager=twoWayKMclient,protocols=[ "TLSv1.2" ],trust-manager=twoWayTMclient) /socket-binding-group=standard-sockets/remote-destination-outbound-socket-binding=my-socket:add(host=localhost,port=8443) /subsystem=undertow/configuration=handler/reverse-proxy=my-proxy:add() /subsystem=undertow/configuration=handler/reverse-proxy=my-proxy/host=localhost:add(outbound-socket-binding=my-socket,ssl-context=twoWaySSCclient,scheme=https) /subsystem=undertow/server= default -server/host= default -host/location=\/proxy:add(handler=my-proxy) reload Import client.p12 certificate into your client Perform request to https://localhost:8443/proxy - this should succeed and no exception in the log Now let's change clients certificate which server does not trust: /subsystem=elytron/key-store=bad:add(type=JKS,path=bad.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret}) /subsystem=elytron/key-manager=bad:add(key-store=bad,credential-reference={clear-text=secret}) /subsystem=elytron/client-ssl-context=twoWaySSCclient:write-attribute(name=key-manager,value=bad) reload Perform request to https://localhost:8443/proxy again and see exceptions in the server.log