Creating a Self-Signed Certificate on JBoss EAP 8.1
There are times when we want our JBoss EAP instances to be accessed via a secure connection (HTTPS) instead of plain, insecure HTTP. The fastest way to achieve this in a development or testing environment is to generate and apply a self-signed certificate.
First, let’s create the self-signed certificate. Be sure to replace your-hostname and your-ipaddress with the actual details of your JBoss EAP server:
$ keytool -genkeypair -alias server \ -keyalg RSA -keysize 4096 -sigalg SHA256withRSA \ -validity 3650 -storetype PKCS12 -keystore keystore.p12 \ -storepass password -keypass password \ -dname "CN=jboss,OU=RH,O=Edwin,C=ID" -ext SAN=dns:your-hostname,ip:your-ipaddress
This command generates a keystore.p12 file. Move this file into your JBOSS_HOME/standalone/configuration/ directory.
Next, we need to reference this new keystore in our standalone.xml. Locate the
<tls> <key-stores> <key-store name="applicationKS"> <credential-reference clear-text="password"/> <implementation type="PKCS12"/> <file path="keystore.p12" relative-to="jboss.server.config.dir"/> </key-store> </key-stores> <key-managers> <key-manager name="applicationKM" key-store="applicationKS"> <credential-reference clear-text="password"/> </key-manager> </key-managers> <server-ssl-contexts> <server-ssl-context name="applicationSSC" key-manager="applicationKM"/> </server-ssl-contexts> </tls>
Start your JBoss EAP and see whether JBoss EAP is leveraging our certificate or not by using a curl command,
$ curl -Ikv https://localhost:8443 * Host localhost:8443 was resolved. * IPv6: ::1 * IPv4: 127.0.0.1 * Trying [::1]:8443... * connect to ::1 port 8443 from ::1 port 40968 failed: Connection refused * Trying 127.0.0.1:8443... * ALPN: curl offers h2,http/1.1 * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384 / x25519 / RSASSA-PSS * ALPN: server accepted h2 * Server certificate: * subject: C=ID; O=Edwin; OU=RH; CN=jboss * start date: Jul 27 12:42:48 2026 GMT * expire date: Jul 24 12:42:48 2036 GMT * issuer: C=ID; O=Edwin; OU=RH; CN=jboss * SSL certificate verify result: self-signed certificate (18), continuing anyway. * Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption * Connected to localhost (127.0.0.1) port 8443 * using HTTP/2 * [HTTP/2] [1] OPENED stream for https://localhost:8443/ * [HTTP/2] [1] [:method: HEAD] * [HTTP/2] [1] [:scheme: https] * [HTTP/2] [1] [:authority: localhost:8443] * [HTTP/2] [1] [:path: /] * [HTTP/2] [1] [user-agent: curl/8.15.0] * [HTTP/2] [1] [accept: */*] > HEAD / HTTP/2 > Host: localhost:8443 > User-Agent: curl/8.15.0 > Accept: */* > * Request completely sent off < HTTP/2 200 HTTP/2 200 < last-modified: Tue, 29 Jul 2025 01:49:24 GMT last-modified: Tue, 29 Jul 2025 01:49:24 GMT < content-length: 1720 content-length: 1720 < content-type: text/html content-type: text/html < accept-ranges: bytes accept-ranges: bytes < date: Mon, 27 Jul 2026 12:50:15 GMT date: Mon, 27 Jul 2026 12:50:15 GMT <
