Securing Jakarta Enterprise Beans with mutual TLS authentication

In order for the client to use a certificate, it must be signed by a server-trusted entity. For the purposes of this demonstration, we will self-sign a certificate and then import it into the server’s truststore. However, such certificates are generally treated as insecure since the identity cannot be externally verified. To use a certificate signed by a trusted Certificate Authority, take a look at this blog post.

We will begin by generating a 2048-bit key pair, and saving it to a local file with the alias client. Using the Java keytool, we store it in a PKCS #12 keystore:

Note that we have also set the common name on the key to client (using the option -dname "CN=client"). Once the key pair is created, we export the certificate to a file:

We will now perform a similar configuration for the WildFly server. Start the server, and then in another terminal connect to it using the management CLI:

(Note: In this post, replace WILDFLY_HOME with the actual path to your WildFly installation.)

We will use the Elytron subsystem to create a keystore to hold the server’s key pair. The keystore will be saved in the server configuration directory, relative to jboss.server.config.dir:

Then, we generate a key pair with alias localhost, and save it to the keystore. Like with the client, we also specify the server’s common name (distinguished-name="CN=localhost").

The self-signed certificate is exported to a file in the configuration directory:

Finally, we create a key manager, which will be used to access the keystore during the TLS handshake:

Since we are already connected to the server, we will import the client certificate first. We configure a new truststore for holding certificates:

We import the client certificate, specifying it with its alias, and then save it to the truststore file. Since this is a self-signed certificate, we will not validate its authenticity.

We also configure a trust manager, which will verify the certificate during the TLS handshake:

With the server now setup, we return to the client. Open a new terminal and navigate to the root folder of this example. We use the keytool once again, identify the server’s certificate by its alias and importing it into a client truststore:

At this point, the client and server both have their corresponding key pairs, and trust the certificates of the other. The TLS configuration is complete.