Creating a Self-Signed Certificate on JBoss EAP 8.1

There are times when we want our JBoss EAP instances to be accessed via a secure connection (HTTPS) instead of plain, insecure HTTP. The fastest way to achieve this in a development or testing environment is to generate and apply a self-signed certificate.

First, let’s create the self-signed certificate. Be sure to replace your-hostname and your-ipaddress with the actual details of your JBoss EAP server:

$ keytool -genkeypair -alias server \ 
	-keyalg RSA -keysize 4096 -sigalg SHA256withRSA \ 
	-validity 3650 -storetype PKCS12 -keystore keystore.p12 \ 
	-storepass password -keypass password \ 
	-dname "CN=jboss,OU=RH,O=Edwin,C=ID" -ext SAN=dns:your-hostname,ip:your-ipaddress

This command generates a keystore.p12 file. Move this file into your JBOSS_HOME/standalone/configuration/ directory.

Next, we need to reference this new keystore in our standalone.xml. Locate the section within the elytron subsystem and update the applicationKS definition to point to your new keystore.p12 file:

<tls>
	<key-stores>
		<key-store name="applicationKS">
			<credential-reference clear-text="password"/>
			<implementation type="PKCS12"/>
			<file path="keystore.p12" relative-to="jboss.server.config.dir"/>
		</key-store>
	</key-stores>
	
	<key-managers>
		<key-manager name="applicationKM" key-store="applicationKS">
			<credential-reference clear-text="password"/>
		</key-manager>
	</key-managers>
	
	<server-ssl-contexts>
		<server-ssl-context name="applicationSSC" key-manager="applicationKM"/>
	</server-ssl-contexts>
</tls>

Start your JBoss EAP and see whether JBoss EAP is leveraging our certificate or not by using a curl command,

$ curl -Ikv https://localhost:8443
* Host localhost:8443 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:8443...
* connect to ::1 port 8443 from ::1 port 40968 failed: Connection refused
*   Trying 127.0.0.1:8443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: C=ID; O=Edwin; OU=RH; CN=jboss
*  start date: Jul 27 12:42:48 2026 GMT
*  expire date: Jul 24 12:42:48 2036 GMT
*  issuer: C=ID; O=Edwin; OU=RH; CN=jboss
*  SSL certificate verify result: self-signed certificate (18), continuing anyway.
*   Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
* Connected to localhost (127.0.0.1) port 8443
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://localhost:8443/
* [HTTP/2] [1] [:method: HEAD]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: localhost:8443]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.15.0]
* [HTTP/2] [1] [accept: */*]
> HEAD / HTTP/2
> Host: localhost:8443
> User-Agent: curl/8.15.0
> Accept: */*
>
* Request completely sent off
< HTTP/2 200
HTTP/2 200
< last-modified: Tue, 29 Jul 2025 01:49:24 GMT
last-modified: Tue, 29 Jul 2025 01:49:24 GMT
< content-length: 1720
content-length: 1720
< content-type: text/html
content-type: text/html
< accept-ranges: bytes
accept-ranges: bytes
< date: Mon, 27 Jul 2026 12:50:15 GMT
date: Mon, 27 Jul 2026 12:50:15 GMT
<