AS7 - How to configure https connector for SSL

[adamhearn]

I'm completely new with using JBoss and have started with AS7. My platform is Windows 2003 x64 and I'm running JRE6 (with JDK 1.6.0_25) and the final AS7 download.

I'd like to configure SSL support but am having difficulty finding instructions that relate to AS7 and/or understanding how I go about it!

Running in 'standalone' mode, I've edited ...\standalone\configuration\standalone.xml adding the following [bold]:

        <subsystem xmlns="urn:jboss:domain:web:1.0" default-virtual-server="default-host">

            <connector name="http" protocol="HTTP/1.1" socket-binding="http" scheme="http"/>

            <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true" />

            <virtual-server name="default-host" enable-welcome-root="true">

                <alias name="localhost"/>

                <alias name="example.com"/>

            </virtual-server>

        </subsystem>

The socket binding is already in place (8443).

The server will start with the above change. I can access both http://localhost:8080/my.jsp and http://localhost:8443/my.jsp

However accessing https://localhost:8443/my.jsp doesn't - the browser waits for a very long time then presents a "cannot display web page" error page. It doesn't look like any errors are logged for this.

Obviously in the world of SSL I need a certificate so I've created a keystore using "keytool -genkey -alias tomcat -keyalg RSA" and copied the file to "...\standalone\configuration\standalone\server.keystore".

Using examples I've seen, I specificed this using the following additional attributes for the connector definition:

     keystoreFile="${jboss.server.home.dir}/configuration/server.keystore" keystorePass="changeit"

But, the server fails to start with an error in the log "Unexpected attribute 'keystoreFile'".

I understand that AS7 is a complete re-write and some of the information, such as the connector XML element attributes, on the web may be out of date so if anyone can supply configuration instructions for SSL I'd very much appreciate it!

Thanks in advance, Adam

[jaikiran]

Moved to AS7 forum.

[jaikiran]

The xsd for the connector element of the web subsystem in AS7 is here http://www.jboss.org/schema/jbossas/jboss-web.xsd. As per the xsd, you'll need a child "ssl" element under the https connector with the relevant details. Follow that xsd and if you need more help, let us know. I think the security documentation which is currently work in progress will have these details and will then be published here https://docs.jboss.org/author/display/AS7/Documentation

[adamhearn]

Thanks for the pointer!

I'm now able to serve my app using SSL. Although it's easy [once you know where to look] here's the connector XML element should anyone else require the information:

            <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true">
                <ssl name="https" password="changeit" certificate-key-file="../standalone/configuration/server.keystore"/>
            </connector>

Obiously the password and keystore path should be changed as required. Note that I could get the certificate-key-file to use a JBoss property - using ${jboss.server.home.dir} - but for my testing it's not a problem.

[jaikiran]

Adam Hearn wrote:

Note that I could get the certificate-key-file to use a JBoss property - using ${jboss.server.home.dir} - but for my testing it's not a problem.

You mean you could not?

In AS7, the system properties set by default are listed here https://docs.jboss.org/author/display/AS7/Admin+Guide#AdminGuide-JVMsettings.

In this case, you need ${jboss.server.config.dir}. So ultimately, it would be ${jboss.server.config.dir}/server.keystore.

[adamhearn]

Sorry, you are correct in that I should have wrote I could not get it to work!

According to the xsd the sslType element doesn't support a "relative-to" attribute so I tried the ${} notation but that didn't work.

Here's exactly what I have just tried:

            <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true">
                <ssl name="https" password="changeit" certificate-key-file="${jboss.server.config.dir}/server.keystore"/>
            </connector>

Output from SysInternals Process Monitor:

15:36:50.6161750 java.exe 4724 CreateFile C:\jboss-as-7.0.0.Final\bin\${jboss.server.config.dir}\server.keystore PATH NOT FOUND Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a

Call stack from server:

15:36:50,531 ERROR [org.apache.tomcat.util.net.jsse.JSSESocketFactory] (MSC service thread 1-1) Failed to load keystore type JKS with path ${jboss.server.config.dir}/server.keystore due to ${jboss.server.config.dir}\server.keystore (The system cannot find the path specified): java.io.FileNotFoundException: ${jboss.server.config.dir}\server.keystore (The system cannot find the path specified)
at java.io.FileInputStream.open(Native Method) [:1.6.0_25]
at java.io.FileInputStream.<init>(FileInputStream.java:120) [:1.6.0_25]
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:374)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:299)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:515)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:452)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:168)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:998)
at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:190)
at org.apache.catalina.connector.Connector.init(Connector.java:976)
at org.apache.catalina.core.StandardService.addConnector(StandardService.java:351)
at org.jboss.as.web.WebServerService.addConnector(WebServerService.java:121)
at org.jboss.as.web.WebConnectorService.start(WebConnectorService.java:223)
at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1765)
at org.jboss.msc.service.ServiceControllerImpl$ClearTCCLTask.run(ServiceControllerImpl.java:2291)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [:1.6.0_25]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [:1.6.0_25]
at java.lang.Thread.run(Thread.java:662) [:1.6.0_25]

Thanks for the support!

[jaikiran]

It looks like system property substitution isn't supported then.

[msteedle]

I do the above configurations and still have errors. I can access https://localhost:8443/my.jsp but that my.jsp connects to another webservice with an https address such as https://www.paypalobjects.com/wsdl/PayPalSvc.wsdl using soap but gets a socket closed error. I can connect to http addresses such as http://www.weather.gov/forecasts/xml/DWMLgen/wsdl/ndfdXML.wsdl but just not https ones.  What do I need to do to allow this.  Ultimately I want to be able to do this using http:// for my app rather than https:// since I dont want my entire app having to go through security stuff.  I just want to be able to connect to secure webservices

thanks 

[adamhearn]

You should really open a new thread - this one was for accessing a JBoss server with SSL.

As I indicated in my 1st post, I'm new to the technology but perhaps your issue is because the connection is being firewalled or maybe the interface configuration does not allow outgoing traffic.

[msteedle]

Ill open a new one.  But the weird thing is that when i run the code from eclipse it works perfectly fine.  It only fails when im trying to run it deployed with jboss

[paul_fath]

I do the above configuration and meet errors as following:

15:00:04,834 ERROR [org.apache.coyote.http11.Http11AprProtocol] (MSC service thread 1-5) Error initializing endpoint: java.lang.Exception: Unable to load certificate key D:/work/server/jboss-as-web-7.0.0.Final/domain/configuration/server.keystore (error:0906D06C:PEM routines:PEM_read_bio:no start line)

    at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)

    at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:660)

    at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:121)

    at org.apache.catalina.connector.Connector.init(Connector.java:976)

    at org.apache.catalina.core.StandardService.addConnector(StandardService.java:351)

    at org.jboss.as.web.WebServerService.addConnector(WebServerService.java:121)

    at org.jboss.as.web.WebConnectorService.start(WebConnectorService.java:223)

    at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1765)

    at org.jboss.msc.service.ServiceControllerImpl$ClearTCCLTask.run(ServiceControllerImpl.java:2291)

    at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886) [:1.6.0_24]

    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908) [:1.6.0_24]

    at java.lang.Thread.run(Thread.java:662) [:1.6.0_24]

.

.

.

Is it caused by something wrong with my server.keystore?But when i do the similar configuration on Tomcat 7.0.2,it really runs well and I can access https://localhost:8443/myApp.

thanks

[jdestef]

Hi,

I have the same issue as Nick. I generated a keystore file with "keytool -genkey -alias jboss -keyalg RSA". Renamed it to keystore.jks and copied it to the configuration directory. Then added <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true">

     <ssl name="https" key-alias="jboss" password="changeit" certificate-key-file="../standalone/configuration/keystore.jks"/></connector> to the standalone.xml file under the web subsystem. When I try to start the server I get the exact same error as Nick above. Using JBoss AS 7.0.1 final on Ubuntu linux/64. Any guidance would be appreciated.

Thx

[dlofthouse]

Just double checked the steps you describe to create the error but no failure here.

Could you please confirm the exact path of the keytool you are using and the Java version you are running this with?

Also what output do you get from the following command?

keytool -list -keystore server.keystore

[jdestef]

Hi Darren,

Thanks for the reply. I did get it work. The problem was I had built the Apache Portable Runtime stuff on my machine in the past for use with an older version of jboss. There is a symbolic link in /usr/lib/ for libtcnative-1.so. I deleted the link so when the web container started to load it could not find any APR libraries. I think if APR is in play then the configuration will be  different as in the JBoss Web documentation.

Thx

[dallar]

P.S.

if u want to use third-part certificate,u should config like below:

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">

    <ssl name="https" certificate-key-file="xxxx" keystore-type="xxxx"/>

</connector>