Configuring SSL

This section allows you to configure the SSL.

To enable the SSL functionality, you must configure SSL properties at the server and at the client side.

Create Key Store with Public and Private Key for encryption

Java provides a tool called keytool, which can be used to manage the key store and to create the private or public pair of keys. The example below creates a pair of 1024 bit keys using the RSA algorithm and adds them to the key store, server.keystore. You can use the key if you have an existing key.

keytool -genkey -alias t24 -keyalg RSA -keysize 1024 -keystore server.keystore -validity 365 -keypass 123456 -storepass 123456

NOTE: Key store is created if it does not exist.

Exporting and Importing the Public Key

Public key should be exported from the key pair that added to the server key store, so that it can be used at the client side.

keytool -export -keystore server.keystore -alias t24 -file server.cer -keypass 123456 -storepass 123456

Then, you should import the key to the client keystore.

keytool -import -trustcacerts -alias t24 -file server.cer -keystore client.keystore -keypass 123456 -storepass 123456

Sample screenshot for Keystore and truststore creation is given below:

After the above commands are executed, the following files are created.

Server Side Configuration

Keystore should be referenced in Jboss configuration. Keystore in the Jboss configuration directory and add server-identities element to the security realm configuration of the application realm are shown below:

Client Side Configuration

In the Security tab, Iocation of Key store, truststore type and the password must be entered.

You can configure the following fields:

Enable SSL — Select or unselect the check box to enable or disable the SSL.
Trust Store Path — Enter the path of the truststore file.
Trust Store Password — Enter the trust store password.
Protocol — Select the protocol that is used for TLS connection

Mule Side TLS Configuration

Select the TAFJ SSL field check box, in Security tab of Inbound and Outbound adapters, is used to enable or disable the SSL configuration.

You should change the port to either 8443 or the port that is configured for secure connector. Here, you can use 8443 port as it is configured in UTP.

You can configure the following VM augments to enable SSL logs.

-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack

Test for TLSv1.0, TLSv1.1, TLSv1.2 in T24

You can configure TLSv1.1, TLSv1.2, TLSv1.0 in standalone.xml in undertow subsystem. Test Mule settings with all the protocols (TLSv1, TLSv1.1, TLSv1.2,). By enabling the SSL logs, you can see the TLS version used by mule as shown below:

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https" max-parameters="10000"/>
				<https-listener name="default-https" enabled-protocols=" TLSv1,TLSv1.1, TLSv1.2" security-realm="ApplicationRealm" socket-binding="https"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
                    <filter-ref name="server-header"/>
                    <filter-ref name="x-powered-by-header"/>
                </host>
            </server>
            <servlet-container name="default">
                <jsp-config/>
                <websockets/>
            </servlet-container>
            <handlers>
                <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
            </handlers>
            <filters>
                <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
                <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
            </filters>
</subsystem>

Log configuration

To see the SSL logs, enter the VM arguments as shown below:

-Djavax.net.debug=ssl:handshake:verbose:keymanager:trustmanager -Djava.security.debug=access:stack

Dark Mode

Expand/Collapse

In this topic