Securing JBoss admin console with SSL not working - ssl

Question

I'm running JBosss AS 7 in a domain mode. When I applied the changes to host.xml, I received the following errors.
[Host Controller] Message: JBAS014789: Unexpected element '{urn:jboss:domain:1.2}socket-binding' encountered
I followed this reference guide.
https://community.jboss.org/wiki/SecuringAdministrationConsoleWithHttps
host.xml
<management>
<security-realms>
<security-realm name="ManagementRealm">
<authentication>
<properties path="mgmt-users.properties" relative-to="jboss.domain.config.dir"/>
</authentication>
<server-identities>
<ssl>
<keystore path=".keystore" relative-to="jboss.home.dir" password="changeit"/>
</ssl>
</server-identities>
</security-realm>
<security-realm name="ApplicationRealm">
<authentication>
<properties path="application-users.properties" relative-to="jboss.domain.config.dir" />
</authentication>
</security-realm>
</security-realms>
<management-interfaces>
<native-interface security-realm="ManagementRealm">
<socket interface="management" port="${jboss.management.native.port:9999}"/>
</native-interface>
<http-interface security-realm="ManagementRealm">
<socket interface="management" port="${jboss.management.http.port:9990}"/>
<socket-binding https="management-https"/>
</http-interface>
</management-interfaces>
</management>
Thanks!

Answer 1

Make correct changes in configuration file on particular row and column as shown in stack trace ParseError at [row,col]:[x,y]

Answer 2

I have been dealing with the same issue, and it's tricky for a number of reasons. I've listed the changes to standalone.xml that got me going. It goes without saying that you need to build a keystore to reference.
The most problematic part of this configuration is that the <ssl> element in management.security-realms.security-realm uses a different syntax than when configuring the <ssl> element in <subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host">. I've listed both elements here to show the contrast. You don't actually need to configure SSL for web services to get secure your console. I added the extra detail to show how they differ.
<management>
<security-realms>
<security-realm name="ManagementRealm">
<server-identities>
<ssl protocol="TLS">
<keystore path="/my/path/to/certs/my_cert.jks" keystore-password="mypass"/>
</ssl>
</server-identities>
<authentication>
<properties path="mgmt-users.properties" relative-to="jboss.server.config.dir"/>
</authentication>
</security-realm>
</security-realms>
<management-interfaces>
<native-interface security-realm="ManagementRealm">
<socket-binding native="management-native"/>
</native-interface>
<http-interface security-realm="ManagementRealm">
<socket-binding http="management-console-https"/>
</http-interface>
</management-interfaces>
</management>
.
.
.
<profile>
.
.
.
<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host">
<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true">
<ssl password="mypass" certificate-key-file="/my/path/to/certs/my_cert.jks" protocol="TLSv1" verify-client="false" certificate-file="/my/path/to/certs/my_cert.jks"/>
</connector>
<virtual-server name="default-host" enable-welcome-root="true">
<alias name="localhost"/>
<alias name="example.com"/>
</virtual-server>
</subsystem>
.
.
.
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
<socket-binding name="http" port="8080"/>
<socket-binding name="https" port="8443"/>
.
.
.
<socket-binding name="management-native" interface="management" port="${jboss.management.native.port:9999}"/>
<socket-binding name="management-console-https" interface="management" port="${jboss.management.console.https.port:9991}"/>
Also, since you won't be using it, remove the old socket-binding:
<socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
I hope that this helps.