Update JBoss configuration to set up client authentication

To update the JBoss configuration, complete the following steps:

1. Download the CA certificate for the digital certificate from the Personal Identity Verification card.

2. Import the CA certificate into a new truststore.

   Windows:

   The truststore type is determined by the Codar environment. That is, if Codar is running in a standard environment, the truststore type must be JKS. If Codar is running in a FIPS 140-2 compliant environment, the truststore type must be PKCS #12.

   For example, in a standard environment, if you named the CA certificate from step 1 CACcert.cer, saved it in C:\ and wanted to create a truststore named CSA_HOME\jboss-as\standalone\configuration\.piv_keystore, run the following command:

   "CSA_JRE_HOME\bin\keytool" -importcert -file C:\CACcert.cer -alias caccert -keystore CSA_HOME\jboss-as\standalone\configuration\.piv_keystore -storepass <password>

   Linux:

   The truststore type must be JKS.

   For example, if you named the CA certificate from step 1 CACcert.cer, saved it in /tmp, and wanted to create a truststore named CSA_HOME/jboss-as/standalone/configuration/.piv_keystore, run the following command:

   CSA_JRE_HOME/bin/keytool -importcert -file /tmp/CACcert.cer -alias caccert -keystore CSA_HOME/jboss-as/standalone/configuration/.piv_keystore -storepass <password>

3. Edit the CSA_HOME\jboss-as\standalone\configuration\standalone.xml file:

   1. Locate the <security-realm name="CsaRealm"> element. Within this element and after </server-identities>, add the following:

      <authentication>
   <truststore path="<location of truststore>" keystore-password="<truststore password>"/>
</authentication>

      For example,

      <security-realm name="CsaRealm">
   <server-identities>
      <ssl>
         <keystore keystore-password="changeit" path="C:\Program Files\HPE\CSA/jboss-as/standalone/configuration/.keystore"/>
      </ssl>
   </server-identities>
   <authentication>
      <truststore path="C:\Program Files\HPE\CSA\jboss-as\
standalone\configuration\.piv_keystore" keystore‑password="TruststorePassword"/>
   </authentication>
</security-realm>

      Linux:

      <security-realm name="CsaRealm">
   <server-identities>
      <ssl>
         <keystore keystore-password="changeit" path="/usr/local/hpe/jboss-as/standalone/configuration/.keystore"/>
      </ssl>
   </server-identities>
   <authentication>
      <truststore path="/usr/local/hpe/jboss-as/standalone/configuration/.piv_keystore" keystore‑password="TruststorePassword"/>
   </authentication>
</security-realm>

      Note This example stores the password in clear text. If you want to use an encrypted password, see Masking Passwords in standalone.xml Using the JBoss vault Script for information about creating a password vault for JBoss.

   2. Locate the https-listener element that contains the name="https and security-realm="CsaRealm" attributes. Add the verify-client="REQUESTED" attribute to this element.

      For example,

      <https-listener enabled-cipher-suites="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, ... " name="https" security-realm="CsaRealm" socket-binding="https" verify-client="REQUESTED"/>