-
Bug
-
Resolution: Done
-
Blocker
-
None
-
None
The legacy security realm automatically can generate a JKS keystore based on the following configuration:
<security-realm name="ApplicationRealm"> <server-identities> <ssl> <keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/> </ssl> </server-identities> <authentication> <local default-user="$local" allowed-users="*" skip-group-loading="true"/> <properties path="application-users.properties" relative-to="jboss.server.config.dir"/> </authentication> <authorization> <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/> </authorization> </security-realm>
The Elytron subsystem can also generate one but is configured to use PKCS#12:
<tls> <key-stores> <key-store name="applicationKS"> <credential-reference clear-text="password"/> <implementation type="PKCS12"/> <file path="application.keystore" relative-to="jboss.server.config.dir"/> </key-store> </key-stores> <key-managers> <key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost"> <credential-reference clear-text="password"/> </key-manager> </key-managers> <server-ssl-contexts> <server-ssl-context name="applicationSSC" key-manager="applicationKM"/> </server-ssl-contexts> </tls>
PKCS#12 would be the better option for the future but as this KeyStore definition is potentially reusing an existing generated KeyStore we will need to drop back to JKS.