The file is essentially the same as the single host configuration I've been using for years, but, I created three different IP addresses for the server, and pointed a different domain at each IP. Then, I replicated the security realm, interfaces, bindings and servers for each of the domain names.

    <management>

        <security-realms>

            <security-realm name="ManagementRealm">

                <server-identities>

                    <ssl>

<keystore path="firstwebsite.keystore" relative-to="jboss.server.config.dir" keystore-password="thepassword" alias="*.firstwebsite.com" key-password="thepassword"/>

                    </ssl>

                </server-identities>

                <authentication>

                    <local default-user="$local" skip-group-loading="true"/>

                    <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>

                </authentication>

                <authorization map-groups-to-roles="false">

                    <properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>

                </authorization>

            </security-realm>

            <security-realm name="ApplicationRealm">

                <authentication>

                    <local default-user="$local" allowed-users="*" skip-group-loading="true"/>

                    <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>

                </authentication>

                <authorization>

                    <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>

                </authorization>

            </security-realm>

<security-realm name="firstwebsite-realm">

                <server-identities>

                    <ssl>

<keystore path="firstwebsite.keystore" relative-to="jboss.server.config.dir" keystore-password="thepassword" alias="*.firstwebsite.com" key-password="thepassword"/>

</ssl>

                </server-identities>

                <authentication>

                    <truststore path="client.truststore" relative-to="jboss.server.config.dir" keystore-password="thepassword"/>

                </authentication>

            </security-realm>

<security-realm name="secondwebsite-realm">

                <server-identities>

                    <ssl>

<keystore path="secondwebsite.keystore" relative-to="jboss.server.config.dir" keystore-password="thepassword" alias="*.secondwebsite.net" key-password="thepassword"/>

</ssl>

                </server-identities>

                <authentication>

                    <truststore path="client.truststore" relative-to="jboss.server.config.dir" keystore-password="thepassword"/>

                </authentication>

            </security-realm>

            <security-realm name="thirdwebsitecom-realm">

                <server-identities>

                    <ssl>

<keystore path="thirdwebsitecom.keystore" relative-to="jboss.server.config.dir" keystore-password="thepassword" alias="*.thirdwebsite.com" key-password="thepassword"/>

</ssl>

                </server-identities>

                <authentication>

                    <truststore path="client.truststore" relative-to="jboss.server.config.dir" keystore-password="thepassword"/>

                </authentication>

            </security-realm>

        </security-realms>

#################################################################################

        <subsystem xmlns="urn:jboss:domain:undertow:3.1">

            <buffer-cache name="default"/>

            <server name="firstwebsite-server">

                <ajp-listener name="firstwebsite-ajp-listener" socket-binding="firstwebsite-ajp" max-parameters="5000"/>

                <http-listener name="firstwebsite-default-listener" socket-binding="firstwebsite-http" redirect-socket="firstwebsite-https-ext"/>

                <https-listener name="firstwebsite-https-listener" socket-binding="firstwebsite-https" max-post-size="1048576000" max-parameters="5000" security-realm="firstwebsite-realm" verify-client="REQUESTED" enabled-protocols="TLSv1.2"/>

                <host name="firstwebsite-host" alias="localhost">

                    <location name="/recording" handler="recording"/>

                    <filter-ref name="cache-control-header"/>

                    <filter-ref name="pragma-header"/>

                    <filter-ref name="expires-header"/>

                    <filter-ref name="x-content-type-options-header"/>

                    <filter-ref name="x-frame-options-header"/>

                    <filter-ref name="x-xss-protection-header"/>

                </host>

            </server>

            <server name="secondwebsite-server">

                <ajp-listener name="secondwebsite-ajp-listener" socket-binding="secondwebsite-ajp" max-parameters="5000"/>

                <http-listener name="secondwebsite-default-listener" socket-binding="secondwebsite-http" redirect-socket="secondwebsite-https-ext"/>

                <https-listener name="secondwebsite-https-listener" socket-binding="secondwebsite-https" max-post-size="1048576000" max-parameters="5000" security-realm="secondwebsite-realm" verify-client="REQUESTED" enabled-protocols="TLSv1.2"/>

                <host name="secondwebsite-host" alias="localhost">

                    <location name="/recording" handler="recording"/>

                    <filter-ref name="cache-control-header"/>

                    <filter-ref name="pragma-header"/>

                    <filter-ref name="expires-header"/>

                    <filter-ref name="x-content-type-options-header"/>

                    <filter-ref name="x-frame-options-header"/>

                    <filter-ref name="x-xss-protection-header"/>

                </host>

            </server>

            <server name="thirdwebsitecom-server">

                <ajp-listener name="thirdwebsitecom-ajp-listener" socket-binding="thirdwebsitecom-ajp" max-parameters="5000"/>

                <http-listener name="thirdwebsitecom-default-listener" socket-binding="thirdwebsitecom-http" redirect-socket="thirdwebsitecom-https-ext"/>

                <https-listener

name="thirdwebsitecom-https-listener"

socket-binding="thirdwebsitecom-https"

max-post-size="1048576000"

max-parameters="5000"

security-realm="thirdwebsitecom-realm"

verify-client="REQUESTED"

enabled-protocols="TLSv1.2"

/>

                <host name="thirdwebsitecom-host" alias="localhost">

                    <location name="/recording" handler="recording"/>

                    <filter-ref name="cache-control-header"/>

                    <filter-ref name="pragma-header"/>

                    <filter-ref name="expires-header"/>

                    <filter-ref name="x-content-type-options-header"/>

                    <filter-ref name="x-frame-options-header"/>

                    <filter-ref name="x-xss-protection-header"/>

                </host>

            </server>

            <servlet-container name="default">

                <jsp-config x-powered-by="false" display-source-fragment="false"/>

                <session-cookie http-only="true" secure="true"/>

                <websockets/>

            </servlet-container>

            <handlers>

                <file name="recording" path="/mnt/recording"/>

            </handlers>

            <filters>

                <response-header name="cache-control-header" header-name="Cache-Control" header-value="no-cache, no-store, must-revalidate, private"/>

                <response-header name="expires-header" header-name="Expires" header-value="0"/>

                <response-header name="pragma-header" header-name="Pragma" header-value="no-cache"/>

                <response-header name="x-content-type-options-header" header-name="X-Content-Type-Options" header-value="nosniff"/>

                <response-header name="x-frame-options-header" header-name="X-Frame-Options" header-value="DENY"/>

                <response-header name="x-xss-protection-header" header-name="X-XSS-Protection" header-value="1; mode=block"/>

            </filters>

        </subsystem>

        <subsystem xmlns="urn:jboss:domain:webservices:2.0">

            <modify-wsdl-address>true</modify-wsdl-address>

            <wsdl-host>${jboss.bind.address:127.0.0.1}</wsdl-host>

            <wsdl-secure-port>${jboss.https.port:8443}</wsdl-secure-port>

            <endpoint-config name="Standard-Endpoint-Config"/>

            <endpoint-config name="Recording-Endpoint-Config">

                <pre-handler-chain name="recording-handlers" protocol-bindings="##SOAP11_HTTP ##SOAP11_HTTP_MTOM ##SOAP12_HTTP ##SOAP12_HTTP_MTOM">

                    <handler name="RecordingHandler" class="org.jboss.ws.common.invocation.RecordingServerHandler"/>

                </pre-handler-chain>

            </endpoint-config>

            <client-config name="Standard-Client-Config"/>

        </subsystem>

        <subsystem xmlns="urn:jboss:domain:weld:3.0"/>

    </profile>

    <interfaces>

        <interface name="management">

            <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>

        </interface>

        <interface name="public">

            <inet-address value="${jboss.bind.address:127.0.0.1}"/>

        </interface>

        <interface name="staging-firstwebsite-com">

            <inet-address value="${jboss.bind.address:172.31.29.111}"/>

        </interface>

        <interface name="staging-secondwebsite-net">

            <inet-address value="${jboss.bind.address:172.31.16.234}"/>

        </interface>

        <interface name="staging-thirdwebsite-com">

            <inet-address value="${jboss.bind.address:172.31.30.103}"/>

        </interface>

        <interface name="private">

            <inet-address value="${jboss.bind.address.private:127.0.0.1}"/>

        </interface>

    </interfaces>

    <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">

        <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>

        <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>

        <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>

        <socket-binding name="http" port="${jboss.http.port:8080}"/>

        <socket-binding name="https-ext" port="${jboss.https.port:443}"/>

        <socket-binding name="https" port="${jboss.https.port:8443}"/>

        <socket-binding name="jgroups-mping" interface="private" port="0" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45700"/>

        <socket-binding name="jgroups-tcp" interface="private" port="7600"/>

        <socket-binding name="jgroups-tcp-fd" interface="private" port="57600"/>

        <socket-binding name="jgroups-udp" interface="private" port="55200" multicast-address="${jboss.default.multicast.address:230.0.0.4}" multicast-port="45688"/>

        <socket-binding name="jgroups-udp-fd" interface="private" port="54200"/>

        <socket-binding name="modcluster" port="0" multicast-address="224.0.1.105" multicast-port="23364"/>

        <socket-binding name="txn-recovery-environment" port="4712"/>

        <socket-binding name="txn-status-manager" port="4713"/>

        <socket-binding name="firstwebsite-ajp" interface="staging-firstwebsite-com" port="${jboss.ajp.port:8009}"/>

        <socket-binding name="firstwebsite-http" interface="staging-firstwebsite-com" port="${jboss.http.port:8080}"/>

        <socket-binding name="firstwebsite-https-ext" interface="staging-firstwebsite-com" port="${jboss.https.port:443}"/>

        <socket-binding name="firstwebsite-https" interface="staging-firstwebsite-com" port="${jboss.https.port:8443}"/>

        <socket-binding name="secondwebsite-ajp" interface="staging-secondwebsite-net" port="${jboss.ajp.port:8009}"/>

        <socket-binding name="secondwebsite-http" interface="staging-secondwebsite-net" port="${jboss.http.port:8080}"/>

        <socket-binding name="secondwebsite-https-ext" interface="staging-secondwebsite-net" port="${jboss.https.port:443}"/>

        <socket-binding name="secondwebsite-https" interface="staging-secondwebsite-net" port="${jboss.https.port:8443}"/>

        <socket-binding name="thirdwebsitecom-ajp" interface="staging-thirdwebsite-com" port="${jboss.ajp.port:8009}"/>

        <socket-binding name="thirdwebsitecom-http" interface="staging-thirdwebsite-com" port="${jboss.http.port:8080}"/>

        <socket-binding name="thirdwebsitecom-https-ext" interface="staging-thirdwebsite-com" port="${jboss.https.port:443}"/>

        <socket-binding name="thirdwebsitecom-https" interface="staging-thirdwebsite-com" port="${jboss.https.port:8443}"/>

        <outbound-socket-binding name="mail-smtp">

            <remote-destination host="my email server" port="465"/>

        </outbound-socket-binding>

    </socket-binding-group>

</server>