How to configure SSL on JBOSS EAP 6.4 with SAN certificate.

Step 1: Locate to JBOSS /configuration folder.

Screenshot 1:

Step 2: open standalone.xml file.  NOTE : Always take backup before doing any config. changes.

Command >> vi  standalone.xml 




Step 3: Add below parameters for ssl configuration below connector http.

----------------------------------------------------------------------------------------------------------

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
<ssl key-alias="ssl" password="142536" certificate-key-file="/JBOSS/JBOSS1/jboss-eap-6.4/standalone/configuration/keystore.jks" verify-client="false" />
</connector>

----------------------------------------------------------------------------------------------------------
Where,
key-alias >> alias name of keystore.
certificate-key-file >> Pathname of the keystore file where you have stored the server certificate to be loaded.
password >> Password of a file.
verify-client >> Set to true if you want the SSL stack to require a valid certificate chain from the client before accepting a connection. (default is false).

Screenshot 3-1:

Screenshot 3-2:

Step 4 : Locate jboss /bin folder and start the jboss.

  I have made a startjboss.sh script and bind my machine IP address.

Screenshot 4-1:

Screenshot 4-2:

Step 5: Check the application on port 8443 with IP (Default port is 8443).

Screenshot 5 :

Step 6: Check the application on port 8443 with CN (CommanName) and SAN (Subject Alternative Name) DNS in certificate.

Before this make entries in hosts file of machine.

Command >> vi    /etc/hosts


Screenshot 6-1:

Step 7 : Check the application using Common Name (CN).

Screenshot 7-1:

Check the application using SAN-DNS.

Screenshot 7-2:

Screenshot 7-3:

Step 8 : To hide port 8443 , change the Port  from 8443  to  443  in standalone.xml  and restart the jboss.

Screenshot 8-1 :

Step 9: Check the application using Common Name (CN).

Screenshot 9 :

Refrence link :  https://docs.jboss.org/jbossweb/7.0.x/config/ssl.html
Refrence link :  https://access.redhat.com/solutions/209023
Refrence link :  https://access.redhat.com/solutions/172203

Link to create self-signed  certificate  http://www.middlewarebox.com

Thanks :-)

How to create Self-signed certificate and CSR using java keytool with SAN details. OR How to create SAN certificate with java keytool.

SAN stands for Subject Alternative Name certificates and allows you to secure multiple domain names with a single SSL certificate.

SAN is used where a single server can access with multiple domain address.

SAN : Through san you specify additional host names (sites, IP addresses, common names, etc.) to be protected by a single SSL Certificate, such as a Multi-Domain (SAN) or Extend Validation Multi-Domain Certificate.


Step 1: Make sure you have installed java in our machine.

Command >> java -version

Screenshot 1:

Step 2: Find installed java location.

Command >>  find  / -name java

Screenshot 2:

Step 3: Locate to /bin folder of java.

Screenshot 3:

Step 4: Use below command to generate java keystore and self-signed certificate.

Command >>  ./keytool -genkey -alias ssl -keyalg RSA -keystore keystore.jks -keysize 2048 -ext SAN=dns:uat.middbox.com,dns:uat.MB.com

Where,  keytool >> Java Keytool is a key and certificate management utility.
       -genkey  >> Generate SSL certificates and certificate requests
  -alias   >> Name given to the certifiacte.
  -keyalg  >> Algorithm to be used in certificate.
  -keystore >> SSL cert to be store in file.
  -keysize  >> RSA key size 2048 ( Certificate authorities will not sign csrs less than 2048 bits in size so you should generate your csr to be 2048 bits. )
  -ext      >> Extension attribute to provide dns and email details its optional to the certificate .


Screenshot 4:

Step 5: Use below command into keytool to create a CSR using existng keystore.jks.

Command >>  ./keytool -certreq -alias ssl -keystore keystore.jks -file MiddBox.csr -ext SAN=dns:uat.middbox.com,dns:uat.MB.com


       -certreq  >> Generates a certificate request
       -file     >> CSR to be store in file.

Screenshot 5:

 

Step 6: Check which certificates are in a Java keystore available.

Commmand >> ./keytool -list -v -keystore keystore.jks

Screenshot 6:

Step 7: Check generated CSR using online CSE decoder website https://certlogik.com/decoder/ .
           

Command >>  cat MiddBox.csr

Output :

-------------------------------------------------------------------------------------------------

-----BEGIN NEW CERTIFICATE REQUEST-----
MIIDEDCCAfgCAQAwczELMAkGA1UEBhMCSW4xDDAKBgNVBAgTA01haDEMMAoGA1UE
BxMDTXVtMRAwDgYDVQQKEwdNaWRkYm94MRYwFAYDVQQLEw1NaWRkbGV3YXJlQm94
MR4wHAYDVQQDExV1YXQubWlkZGxld2FyZWJveC5jb20wggEiMA0GCSqGSIb3DQEB
AQUAA4IBDwAwggEKAoIBAQCu1mxQDADQvRxBFYPkJ7GxcYTPIATqElOXgxX8E03A
FNUzPROplCr4UgcCUXo6LUMJGr/oPTlIzSyizMSYt4YSlti8Uw0AjLcai/EcgHOI
9Nu6Xm7A8KSd1gZJZuIdAj9HfoNbGmQvjATvYwYgdSdtkMpxwwk46tcALnDJwTIB
IWYY3eQC660BwrOOvjq8fqTLYrDhRlzhBMjFuqAd7sqQO2W5tMwrlYUZ6NoLVYHH
Uu5kej+axdQb4Q7kl7ULwaCtImrfGqJq8zM0/i/Qu/xPAydO8vopscI+fjJvJ3ix
a5ExHu0jKGJOcvlcizFxbYJiqy0502g+gAd+38bMr6HRAgMBAAGgWDBWBgkqhkiG
9w0BCQ4xSTBHMCYGA1UdEQQfMB2CD3VhdC5taWRkYm94LmNvbYIKdWF0Lk1CLmNv
bTAdBgNVHQ4EFgQUsW0GTWPc1w+S8oE9JPSUVV3eH4kwDQYJKoZIhvcNAQELBQAD
ggEBAGnRc3lshhh0zjkEmJdFJTEZx/XYc8ZMhLhpGAnGjCZVxWMnPJzd0O0Ayzyy
dyMM+C0rWefMEsZKUE4kQufycUigVVfohhze9XyL0+eCFznqUpBkF4eFKh4qetOr
ww9KpjA0vMCmhEFtwfd5BfS6+a/sMKLypVQDEGnAH1dMEfjUdkvNo72OwX25dIOC
oDTyzuX+BqDk99j52JQESmd7AIV2FbeszmURCCFHmds8bcopvtS3y1fsnwztS0OQ
mas/zbX3vgmR7Cx5Ac9QxreDx34G+9UM5Wo1vykc98R6uSbDPJOe0gyPDsa9Nt3C
A3UyYiiLX45YLq8LqLQtf2XH6t8=
-----END NEW CERTIFICATE REQUEST-----


-------------------------------------------------------------------------------------------------

Copy above encrypted code and paste into https://certlogik.com/decoder/


Screenshot 7-1:

Screenshot 7-2:

Screenshot 7-3:

Reference link : https://www.sslsupportdesk.com/java-keytool-commands/
Reference link : https://www.sslshopper.com/what-is-ssl.html
Reference link : https://www.digicert.com/ssl/
Reference link : https://www.websecurity.symantec.com/



Thanks :-)

How to Install Apache HTTP Server 2.4.27 Latest Version on LINUX machine

Step 1: make one directory APACHEWEB [in my case].

Command >> mkdir APACHEWEB



Step 2: Locate to APACHEWEB directory use below command to downlaod Apache HTTP Server 2.4.27.

Command >> wget http://redrockdigimark.com/apachemirror//httpd/httpd-2.4.27.tar.gz

Screenshot 2-1 :
 

OR

Download from this link  https://httpd.apache.org/download.cgi#apache24

Screenshot 2-2:

Step 3 : Change the permission to this directory

Command >> chmod -R 755 /APACHEWEB

Screenshot 3:

Step 4: Following requirements you need to be complete.

Refrence link : https://httpd.apache.org/docs/2.4/install.html

Screenshot 4:

Step 5: Extract this httpd-2.4.27.tar.gz

Command >> tar -xvzf httpd-2.4.27.tar.gz

Screenshot 5:

Step 6: locate to /APACHEWEB/httpd-2.4.27/srclib  , since no pre-libraries are there ,so we have to downlaod libraries.

Screenshot 6:

Step 7: Let's complete this requirements execute below commands on lcation /APACHEWEB/httpd-2.4.27/srclib directory :

      7-1 : Download  Apache Portable Runtime (APR) and Apache Portable Runtime (APR-Util) Utility 1.6.0 :

  Command for APR >> wget http://redrockdigimark.com/apachemirror//apr/apr-1.6.2.tar.gz

  OR

  Download Link : http://apr.apache.org/download.cgi

  Screenshot 7-1:

  7-2: Download Apache Portable Runtime (APR-Util) Utility 1.6.0 :

  Command >> wget http://redrockdigimark.com/apachemirror//apr/apr-util-1.6.0.tar.gz

  OR

  Download Link :  http://apr.apache.org/download.cgi

  Screenshot 7-2:

Step 8 : Extract this APR and APR Util.


8-1: Extract  apr-1.6.2.tar.gz

Command >>  tar -xvzf apr-1.6.2.tar.gz

Screenshot 8-1:

8-2: Extract apr-util-1.6.0.tar.gz

Command >>  tar -xvzf apr-util-1.6.0.tar.gz

Screenshot 8-2:

Step 9: Rename  apr-util-1.6.0 and apr-1.6.2 version info.

Command >> mv apr-util-1.6.0   apr-util

Command >>  mv  apr-1.6.2    apr

IMP NOTE : After rename please move "apr-util"  & "apr" to "/APACHEWEB/httpd-2.4.27/srclib"


Screenshot 9:

Step 10 : Also make sure this rpm are intsalled on LINUX machine before installation.

Command >>  yum install pcre-devel

 Screenshot 10-1:

Command >>  yum install openssl-devel

 Screenshot 10-2:

Command >>  yum install expat-devel

 Screenshot 10-3:

Command >>  yum install gcc 

 Screenshot 10-4:

Step 11 : Once again change the permission.

Command >>  chmod -R 755 /APACHEWEB



Step 12: locate  to /APACHEWEB/httpd-2.4.27 and use below commands.

Command >>  ./configure --with-included-apr   --prefix=/APACHEWEB/HTTPDWEB2.4 --enable-ssl --enable-so

Where,


--with-included-apr=Apache Portable Runtime (APR) and Apache Portable Runtime libraries on location srclib
–prefix=Provide location where you need to install apache ,  /APACHEWEB/HTTPDWEB2.4 in my case
–enable-ssl this will compile apache with SSL enabled so can secure apache web server with SSL cert.
–enable-so

others sonfiguration options :-
   
"./configure" \
"--enable-so" \
"--enable-proxy" \
"--enable-proxy-http" \
"--enable-proxy-balancer" \
"--enable-rewrite" \
"--enable-proxy-ajp" \
"--prefix=" 



 Screenshot :

Step 13 : on same location /APACHEWEB/httpd-2.4.27 use  below commands.

Command >> make 

Screenshot 13:

Step 14 :  on same location /APACHEWEB/httpd-2.4.27 use  below commands.

Command >> make install

Screenshot 14 :

Step 15 : locate to /APACHEWEB/HTTPDWEB2.4  where  new installation of   httpd server  has done. [--prefix=/APACHEWEB/HTTPDWEB2.4 ]

Screenshot 15:

Step 16: locate to bin directory of installed httpd server 2.4  and start the server .

Command >> ./apachectl  -k start

Screenshot 16:

Step 17: Now, check through browser.

Screenshot 17 :

Step 18 : For  Reference doc use below link

                https://httpd.apache.org/docs/2.4/    
                https://httpd.apache.org/docs/2.4/install.html
                http://httpd.apache.org/docs/trunk/programs/configure.html





Thanks..! :-)

Running Multiple Instance of JBoss EAP 6.4 Standalone Servers on a Single Machine

Step 1: Make One more Directory.

Command >> mkdir JBOSS2

Screenshot 1:

Step 2: Copy previously created JBOSS1 instance to JBOSS2

Command >> cp -pr jboss-eap-6.4   /JBOSS/JBOSS2/

Screenshot 2:

 If doesn't have already jboss instance click here:-)



Step 3:  Locate to /JBOSS/JBOSS2/jboss-eap-6.4/bin and run  ./standalone.sh 

Command >> ./standalone.sh   -b=192.168.216.134    -bmanagement=192.168.216.134 -Djboss.socket.binding.port-offset=100


Where,

-b=XXX.XXX.XXX.XXX is use to  bind Application “public” interface to a specific IP address.

-bmanagement=XXX.XXX.XXX.XXX is use  to bind “management” interface to a specific IP address.

-Djboss.socket.binding.port-offset=100 is use  to avoid port conflict.



Screenshot 3-1:

Screenshot 3-2:

Screenshot 3-3:

Screenshot 3-4: