JBoss SSL configuration

[sreekanth.munarai]

Hi All,

I'm trying to configure SSL at JBoss level. Below are the steps that i followed:

1. i have created an  test.keystore certificate using below command:

       keytool -genkey -alias Test -keyalg RSA -keystore Test.keystore -validity 10950

2. Placed it under the folder D:\Sreekanth\JBoss7.1AS\jboss-as-7.1.1.Final\standalone\configuration\Keystore\test.keystore

3. Standalone.xml configuration changes :

  <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true">

    <ssl name="Test-ssl" password="Test@123" protocol="TLSv1" key-alias="Test" certificate-key-file="${jboss.server.config.dir}/configuration/Keystore/test.keystore"/>

    </connector>

When trying to start the server, getting below parse error:

12:39:42,449 ERROR [org.jboss.as.server] JBAS015956: Caught exception during boot: org.jboss.as.controller.persistence.ConfigurationPersistenceException: J

BAS014676: Failed to parse configuration

        at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:141) [jboss-as-controller-7.1.1.Final.jar:7.1.

1.Final]

        at org.jboss.as.server.ServerService.boot(ServerService.java:266) [jboss-as-server-7.1.1.Final.jar:7.1.1.Final]

        at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:155) [jboss-as-controller-7.1.1.Final.jar:7.1.1.Final]

        at java.lang.Thread.run(Thread.java:662) [rt.jar:1.6.0_35]

Caused by: com.ctc.wstx.exc.WstxParsingException: Received non-all-whitespace CHARACTERS or CDATA event in nextTag().

at [row,col {unknown-source}]: [259,5]

        at com.ctc.wstx.sr.StreamScanner.constructWfcException(StreamScanner.java:606)

        at com.ctc.wstx.sr.StreamScanner.throwParseError(StreamScanner.java:479)

        at com.ctc.wstx.sr.StreamScanner.throwParseError(StreamScanner.java:464)

        at com.ctc.wstx.sr.BasicStreamReader.nextTag(BasicStreamReader.java:1137)

        at org.jboss.staxmapper.XMLExtendedStreamReaderImpl.nextTag(XMLExtendedStreamReaderImpl.java:152) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

        at org.jboss.as.web.WebSubsystemParser.parseConnector(WebSubsystemParser.java:831)

        at org.jboss.as.web.WebSubsystemParser.readElement(WebSubsystemParser.java:325)

        at org.jboss.as.web.WebSubsystemParser.readElement(WebSubsystemParser.java:65)

        at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

        at org.jboss.staxmapper.XMLExtendedStreamReaderImpl.handleAny(XMLExtendedStreamReaderImpl.java:69) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

        at org.jboss.as.server.parsing.StandaloneXml.parseServerProfile(StandaloneXml.java:894) [jboss-as-server-7.1.1.Final.jar:7.1.1.Final]

        at org.jboss.as.server.parsing.StandaloneXml.readServerElement_1_1(StandaloneXml.java:330) [jboss-as-server-7.1.1.Final.jar:7.1.1.Final]

        at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:127) [jboss-as-server-7.1.1.Final.jar:7.1.1.Final]

        at org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:100) [jboss-as-server-7.1.1.Final.jar:7.1.1.Final]

        at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:110) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

        at org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:69) [staxmapper-1.1.0.Final.jar:1.1.0.Final]

        at org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:133) [jboss-as-controller-7.1.1.Final.jar:7.1.

1.Final]

        ... 3 more

It is throwing parsing error at line 259 where i have added ssl connector. I'm not able to find where i m going wrong. Please revert with your findings/suggestions. Thanks in advance.

Sreekanth

[jaysensharma]

Please check:               certificate-key-file="${jboss.server.config.dir}/configuration/Keystore/test.keystore"/>

I guess it should be :    certificate-key-file="${jboss.server.config.dir}/Keystore/test.keystore"/>

because the "jboss.server.config.dir"  system property itself includes the path till  "$PROFILE/configuration" directory (like standalone/configuration).  

Regards

Jay SenSharma

[sreekanth.munarai]

hi Jay, Thanks for your suggestion, server start up without any errors. However, when i'm trying to access the console with port 8443 for https as https://localhost:8443/console getting below error:

Server has a weak ephemeral Diffie-Hellman public key

ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY

I'm using Chrome. please suggest what can be done?

[jaysensharma]

Good to know that now the Server is starting correctly and you are not getting the previous error.

Regarding your current query "ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY"

        That warning is caused by the size of the group used for ephemeral Diffie Hellman key exchange being too small. So small that the symmetric keys can be extracted by academics.

The certificate does not affect the size of the group used for DHE. The configuration of the web server does.

Currently the recommendation is that the group size in bits should be as large as the RSA key for the certificate, usually 2048 bits, and in any case no smaller than 1024 bits. Also, you must generate your own group, not use a predefined one, or else 1024 bits is not enough.

     Please see:   https://community.spiceworks.com/topic/1173437-error-in-google-chrome-and-other-browsers-err_ssl_weak_server_ephemeral_dh_key

Regards

Jay SenSharma

[sreekanth.munarai]

Hi Jay,

Thanks for your information. However, for the time being i have made security changes in Mozilla firefox browser referring below link Server has a weak ephemeral Diffie-Hellman public key | LearnCisco.net

I'm able to access the deployed application thru https link but JBoss console is redirected to http link.

How can we generate large 2048bit cert? have googled but no luck. Thanks.