Wildfly 10 HTTPS certificate fine on 8443 but on 443 says bad certificate - ssl

Question

I am trying to configure Wildfly (10) to use an SSL certificate for HTTPS. It seems to work fine for 8443 (using https://example.com:8443 -- no errors and certificate shows it is signed by the CA), but when I switch the HTTPS to port 443, whenever I access the site (via https://example.com it tells me my certificate was not installed right, the connection is not secure and it's using a self-signed key).
Here are snippets from my standalone.xml file:
Security Realm
<security-realm name="ApplicationRealm">
<server-identities>
<ssl>
<keystore path="devifs.jks" relative-to="jboss.server.config.dir" keystore-password="yadayada" alias="tomcat" key-password="yadayada"/>
</ssl>
</server-identities>
<authentication>
<local default-user="$local" allowed-users="*" skip-group-loading="true"/>
<properties path="application-users.properties" relative-to="jboss.server.config.dir"/>
</authentication>
<authorization>
<properties path="application-roles.properties" relative-to="jboss.server.config.dir"/>
</authorization>
</security-realm>
Undertow Subsystem
<subsystem xmlns="urn:jboss:domain:undertow:3.0">
<buffer-cache name="default"/>
<server name="default-server">
<http-listener name="default" socket-binding="http" redirect-socket="https"/>
<https-listener name="default-ssl" security-realm="ApplicationRealm" socket-binding="https"/>
<host name="default-host" default-web-module="hatteras.war" alias="localhost">
<location name="/" handler="welcome-content"/>
<location name="/reports/" handler="ifsreports"/>
<filter-ref name="server-header"/>
<filter-ref name="x-powered-by-header"/>
</host>
</server>
....
</subsystem>
Socket Binding Group
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
<socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
<socket-binding name="http" port="${jboss.http.port:8080}"/>
<socket-binding name="https" port="${jboss.https.port:443}"/>
<socket-binding name="txn-recovery-environment" port="4712"/>
<socket-binding name="txn-status-manager" port="4713"/>
<outbound-socket-binding name="mail-smtp">
<remote-destination host="localhost" port="25"/>
</outbound-socket-binding>
</socket-binding-group>
I've restarted Wildfly and even the server after making the standalone.xml changes. No luck.
Stack:
Wildfly 10.0.0.final
Ubuntu 14.04.4 LTS
AWS
Any suggestions?

Answer 1

My SSL contact pointed out that JBoss cannot run on 443 because it's a privileged port. This lead me to research and I found I should redirect the port using: iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443 Is this the correct method? Seems to work fine.