Update JBoss Configuration to Set Up Client Authentication

1. Download the CA certificate for the digital certificate from the PIV card.

2. Import the CA certificate into a new truststore.

   The truststore type is determined by the CSA environment. That is, if CSA is running in a standard environment, the truststore type must be JKS. If CSA is running in a FIPS 140-2 compliant environment, the truststore type must be PKCS #12.

   For example, if you named the CA certificate from step 1 CACcert.cer, saved it in /tmp/ for Linux or \Temp\ for Windows, and want to create a truststore named CSA_HOME/jboss-as/standalone/configuration/.piv_keystore, run the following command:

   Windows:

   CSA_JRE_HOME\bin\keytool" -importcert -file C:\Temp\CACcert.cer -alias caccert
-keystore CSA_HOME\jboss-as\standalone\configuration\.piv_keystore -storepass changeit

   Linux:

   CSA_JRE_HOME\bin/keytool -importcert -file /tmp/CACcert.cer -alias caccert
-keystore CSA_HOME/jboss-as/standalone/configuration/.piv_keystore -storepass changeit

3. Edit the CSA_HOME/jboss-as/standalone/configuration/standalone.xml file:

   1. Locate the <security-realm name="CsaRealm"> element. Within this element and after </server-identities>, add the following:

      <authentication>
   <truststore path="<location of truststore>" keystore-password="<truststore password>"/>
</authentication>

      For example,

      Windows:

      <security-realm name="CsaRealm">
   <server-identities>
      <ssl>
         <keystore keystore-password="changeit" path="C:\Program Files\HPE\CSA/jboss-as/standalone/configuration/.keystore"/>
      </ssl>
   </server-identities>
   <authentication>
      <truststore path="C:\Program Files\HPE\CSA\jboss-as\
standalone\configuration\.piv_keystore" keystore‑password="TruststorePassword"/>
   </authentication>
</security-realm>

      Linux:

      <security-realm name="CsaRealm">
   <server-identities>
      <ssl>
         <keystore keystore-password="changeit" path="/usr/local/hpe/jboss-as/standalone/configuration/.keystore"/>
      </ssl>
   </server-identities>
   <authentication>
      <truststore path="/usr/local/hpe/jboss-as/standalone/configuration/.piv_keystore" keystore‑password="TruststorePassword"/>
   </authentication>
</security-realm>

      Note This example stores the password in clear text. If you want to use an encrypted password, see Masking Passwords in standalone.xml Using the JBoss vault Script for information about creating a password vault for JBoss.

   2. Locate the https-listener element that contains the name="https and security-realm="CsaRealm" attributes. Add the verify-client="REQUESTED" attribute to this element.

      For example,

      <https-listener enabled-cipher-suites="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, ... " name="https" security-realm="CsaRealm" socket-binding="https" verify-client="REQUESTED"/>