Uploaded image for project: 'WildFly Core'
  1. WildFly Core
  2. WFCORE-5238

The Elytron applicationKS uses a different type to the legacy realm.

XMLWordPrintable

      The legacy security realm automatically can generate a JKS keystore based on the following configuration:

                  <security-realm name="ApplicationRealm">
                      <server-identities>
                          <ssl>
                              <keystore path="application.keystore" relative-to="jboss.server.config.dir" keystore-password="password" alias="server" key-password="password" generate-self-signed-certificate-host="localhost"/>
                          </ssl>
                      </server-identities>
                      <authentication>
                          <local default-user="$local" allowed-users="*" skip-group-loading="true"/>
                          <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
                      </authentication>
                      <authorization>
                          <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
                      </authorization>
                  </security-realm> 

      The Elytron subsystem can also generate one but is configured to use PKCS#12:

                  <tls>
                      <key-stores>
                          <key-store name="applicationKS">
                              <credential-reference clear-text="password"/>
                              <implementation type="PKCS12"/>
                              <file path="application.keystore" relative-to="jboss.server.config.dir"/>
                          </key-store>
                      </key-stores>
                      <key-managers>
                          <key-manager name="applicationKM" key-store="applicationKS" generate-self-signed-certificate-host="localhost">
                              <credential-reference clear-text="password"/>
                          </key-manager>
                      </key-managers>
                      <server-ssl-contexts>
                          <server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
                      </server-ssl-contexts>
                  </tls> 

      PKCS#12 would be the better option for the future but as this KeyStore definition is potentially reusing an existing generated KeyStore we will need to drop back to JKS.

       

            darran.lofthouse@redhat.com Darran Lofthouse
            darran.lofthouse@redhat.com Darran Lofthouse
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: