如何在 Wildfly 10 独立模式下启用 TLS v1.2？

Question

需要帮助以确保我们的 Wildfly 10 服务器（安装在 Ubuntu 16.04.1 LTS 上）仅支持 TLS v1.2 及更高版本。

如何检查当前的 ssl 证书版本？

我们通过编辑 standalone.xml 在我们的服务器中启用了 https

    <security-realms>
        <security-realm name="ManagementRealm">
            <authentication>
                <local default-user="$local" skip-group-loading="true"/>
                <properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
            </authentication>
            <authorization map-groups-to-roles="false">
                <properties path="mgmt-groups.properties" relative-to="jboss.server.config.dir"/>
            </authorization>
        </security-realm>
        <security-realm name="ApplicationRealm">
            <server-identities>
                <ssl>
                    <keystore path="server.keystore" relative-to="jboss.server.config.dir" keystore-password="serverpassword" alias="server" key-password="serverpassword"/>
                </ssl>
            </server-identities>
            <authentication>
                <local default-user="$local" allowed-users="*" skip-group-loading="true"/>
                <properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
            </authentication>
            <authorization>
                <properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
            </authorization>
        </security-realm>
    </security-realms>
    <subsystem xmlns="urn:jboss:domain:security:1.2">
        <security-domains>
            <security-domain name="other" cache-type="default">
                <authentication>
                    <login-module code="Remoting" flag="optional">
                        <module-option name="password-stacking" value="useFirstPass"/>
                    </login-module>
                    <login-module code="RealmDirect" flag="required">
                        <module-option name="password-stacking" value="useFirstPass"/>
                    </login-module>
                </authentication>
            </security-domain>
            <security-domain name="jboss-web-policy" cache-type="default">
                <authorization>
                    <policy-module code="Delegating" flag="required"/>
                </authorization>
            </security-domain>
            <security-domain name="jboss-ejb-policy" cache-type="default">
                <authorization>
                    <policy-module code="Delegating" flag="required"/>
                </authorization>
            </security-domain>
            <security-domain name="jaspitest" cache-type="default">
                <authentication-jaspi>
                    <login-module-stack name="dummy">
                        <login-module code="Dummy" flag="optional"/>
                    </login-module-stack>
                    <auth-module code="Dummy"/>
                </authentication-jaspi>
            </security-domain>
        </security-domains>
    </subsystem>
    <subsystem xmlns="urn:jboss:domain:undertow:3.0">
        <buffer-cache name="default"/>
        <server name="default-server">
            <http-listener name="default" socket-binding="http" redirect-socket="https"/>
            <https-listener name="httpsServer" security-realm="ApplicationRealm" socket-binding="https"/>
            <host name="default-host" alias="localhost">
                <location name="/" handler="welcome-content"/>
                <filter-ref name="server-header"/>
                <filter-ref name="x-powered-by-header"/>
            </host>
        </server>
        <servlet-container name="default">
            <jsp-config/>
            <websockets/>
        </servlet-container>

Answer 1

编辑 standalone.xml 文件中的 https-listener 标签。并重新启动wildfly 服务器。

<https-listener name="httpsServer" security-realm="ApplicationRealm" socket-binding="https" enabled-protocols="TLSv1.2"/>

通过从link运行 TestSSLServer 确保相同。

TestSSLServer4.exe localhost 8443