如何在JBoss EAP 7.4.3中正确配置指定TLSv1.2加密套件？

加密套件与TLS版本的正确配置位置是SSL连接器（应用HTTPS服务）或SSL上下文节点（管理控制台HTTPS服务），而非ManagementRealm的通用配置项。以下是两种可行的配置方式：

方法一：使用JBoss CLI命令配置（推荐） #

1. 启动JBoss EAP后，连接到CLI工具：

   ./jboss-cli.sh --connect  # Linux/macOS
   # Windows环境使用 jboss-cli.bat --connect
   

2. 配置应用HTTPS连接器（针对Undertow子系统的默认HTTPS服务）：

   # 指定仅启用TLSv1.2
   /subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=enabled-protocols,value=["TLSv1.2"])
   
   # 设置指定的加密套件
   /subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=cipher-suite,value="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256")
   

3. 若需配置管理控制台的HTTPS服务（ManagementRealm下的SSL）：

   /core-service=management/security-realm=ManagementRealm/server-identity=ssl:write-attribute(name=enabled-protocols,value=["TLSv1.2"])
   /core-service=management/security-realm=ManagementRealm/server-identity=ssl:write-attribute(name=cipher-suite,value="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256")
   

4. 保存配置并重启服务：

   :reload
   

方法二：手动编辑配置文件 #

1. 配置应用HTTPS连接器（编辑standalone.xml或domain.xml） #

找到Undertow子系统下的<https-listener>节点，添加或更新enabled-protocols和cipher-suite属性：

<subsystem xmlns="urn:jboss:domain:undertow:12.0">
    <server name="default-server">
        <!-- 其他配置 -->
        <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm"
                        enabled-protocols="TLSv1.2"
                        cipher-suite="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"/>
        <!-- 其他配置 -->
    </server>
</subsystem>

2. 配置管理控制台SSL（编辑standalone.xml或domain.xml） #

找到ManagementRealm下的<server-identity>节点，在<ssl>标签中添加对应属性：

<core-service name="management">
    <security-realm name="ManagementRealm">
        <!-- 其他配置 -->
        <server-identity>
            <ssl protocol="TLSv1.2"
                 enabled-protocols="TLSv1.2"
                 cipher-suite="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"
                 keystore path="mgmt.jks" relative-to="jboss.server.config.dir" keystore-password="your-password"/>
        </server-identity>
        <!-- 其他配置 -->
    </security-realm>
</core-service>

配置完成后，重启JBoss EAP服务即可生效。可通过openssl s_client -connect localhost:8443 -tls1_2命令验证加密套件是否正确加载。

内容的提问来源于stack exchange，提问作者Aniruddha Chunne