Upgrade Guide › Upgrade from CA ControlMinder r12.0 SP1 › How to Upgrade from r12.0 SP1 › Upgrade the Enterprise Management Server › SSL Communication for JBoss

SSL Communication for JBoss

By default, JBoss is not installed with SSL support. This means that all communication between CA ControlMinder Enterprise Management and JBoss is not encrypted. You can configure JBoss to use SSL for secure communication.

Note: For more information about how to configure SSL for JBoss, refer to the JBoss product documentation.

Example: Configure JBoss for SSL Communication on Windows

This example shows you how to configure the JBoss application server to use SSL for secure communication.

Important! This procedure describes how to configure JBoss to use SSL for secure communication using JBoss version 4.2.3 and JDK version 1.5.0.

Follow these steps:

1. Stop JBoss if it is running.
2. Open a command-prompt window and navigate to the following directory:

   JBoss_HOME\server\default\deploy\IdentityMinder.ear\custom\ppm\truststore
   

3. Enter the following command to change the default ssl,keystore password:

   keytool -storepasswd -new password -keystore ssl.keystore -storepass secret
   

   -storepasswd

   Specifies to change the keystore password. The password must be at least six (6) characters long.

   -keystore

   Specifies the keystore name to add the certificate.

   -keystore

   Specifies the keystore name.

   -storepass

   Defines the password used to protect the keystore.

4. Enter the following command to create a key for the Enterprise Management Server:

   keytool -genkey -alias entm -keystore ssl.keystore -keyalg RSA
   

   -genkey

   Specifies that the command should generate a key pair (public and private keys).

   -alias

   Defines the alias to use for adding an entry to the keystore.

   -keyalg

   Specifies the algorithm to use to generate the key pair.

   The keytool utility starts.

5. Enter the password secret.
6. Complete the prompts as required and press enter to verify the parameters you entered.

   The certificate is added to the keystore.

   Note: The keystore and key alias must use identical passwords.

7. Enter the following command to encrypt the keystore password to a file:

   java -cp JBoss_HOME/server/default/lib/jbossx.jar org.jboss.security.plugins.FilePassword welcometojboss 13 passowrd <kestore_password> keystore.password
   

   Note: The Salt and IterationCount are the variables that define the strength of the encrypted password. In the this example, "welcometojboss" is the salt and 13 is the iteration count.

8. Locate the file named server.xml in the following directory and open it for editing:

   JBossInstallDir\server\default\deploy\jboss-web.deployer
   

9. Locate the <Connector Port> tag in the following section:

   <!-- Define a SSL HTTP/1.1 Connector on port 8443
            This connector uses the JSSE configuration, when using APR, the 
            connector should be using the OpenSSL style configuration
            described in the APR documentation -->
       <!--
       <Connector port="18443" protocol="HTTP/1.1" SSLEnabled="true"
                  maxThreads="150" scheme="https" secure="true"
                  clientAuth="false" sslProtocol="TLS" />
   

   Note: The connector port number corresponds to the JBoss HTTPS Port number that you specified during the prerequisite or CA ControlMinder Enterprise Management installation process.

10. Uncomment the "<!--" above the <Connector port> tag.

    You can now edit this tag.

11. Add the following properties to the <Connector port> tag:

    securityDomain="java:/jaas/encrypt-keystore-password" SSLImplementation="org.jboss.net.ssl.JBossImplementation"
    

12. Save and close the server.xml file.
13. Navigate to the following directory to locate the jboss-service.xml file:

    JBOss_HOME/server/default/deploy/jboss-web.deployer/META-INF
    

14. Add the following mbean between the <server> and </server> tags:

    <mbean code="org.jboss.security.plugins.JaasSecurityDomain" name="jboss.security:service=PBESecurityDomain">                        
          <constructor>                                                           
             <arg type="java.lang.String" value="encrypt-keystore-password"></arg>
          </constructor>                                                          
          <attribute name="KeyStoreURL">${jboss.server.home.dir}/deploy/IdentityMinder.ear/custom/ppm/truststore/ssl.keystore</attribute>                                                          
          <attribute name="KeyStorePass">{CLASS}org.jboss.security.plugins.FilePassword:${jboss.server.home.dir}/deploy/IdentityMinder.ear/custom/ppm/truststore/keystore.password</attribute>
    <attribute name="Salt">welcometojboss</attribute>
    <attribute name="IterationCount">13</attribute>
     </mbean>
    

    Note: In the above example,welcometojboss is the salt and 13 is the iteration count.

15. Save and close the jboss-service.xml
16. Start and open CA ControlMinder Enterprise Management.

    Note: After you complete this procedure, you can select to connect to JBoss, and CA ControlMinder Enterprise Management, in either SSL or non-SSL modes.