如何配置WildFly/JBoss使用windows-my中的DNS命名证书（已加sunMSCAPI模块）

Alright, let's walk through setting up SSL on WildFly/JBoss to use your DNS-named certificate (like myapp.mydomain.com) from the Windows windows-my keystore, plus optional trust configuration using windows-root. Since you mentioned you already added the sunMSCAPI module, we’ll focus on the core configuration steps, but I’ll include a quick validation check for that module first just to be safe.

Step 1: Validate the sunMSCAPI Module #

First, double-check that your sunMSCAPI module is correctly set up. Navigate to your WildFly installation’s modules/system/layers/base/sun/security/sunMSCAPI/main directory and confirm there’s a module.xml with this content:

<?xml version="1.0" encoding="UTF-8"?>
<module name="sun.security.sunMSCAPI" xmlns="urn:jboss:module:1.3">
    <resources>
        <!-- No JAR needed; this uses JDK's built-in SunMSCAPI provider -->
    </resources>
    <dependencies>
        <module name="javax.api"/>
        <module name="sun.jdk"/>
    </dependencies>
</module>

If this looks good, we can move on to the SSL configuration.

Step 2: Configure the SSL Connector and Security Realm #

Open your WildFly configuration file (either standalone.xml for standalone mode or domain.xml for domain mode) and make these changes:

2.1 Add/Update the Security Realm #

Find the <security-realms> section and add a new realm for SSL (or modify an existing one):

<security-realm name="SslRealm">
    <server-identities>
        <!-- Use the Windows-MY keystore for your server certificate -->
        <ssl>
            <keystore type="Windows-MY" provider="SunMSCAPI" alias="myapp.mydomain.com"/>
        </ssl>
    </server-identities>
    <!-- Optional: Use Windows-ROOT as the trust store for trusted CA certificates -->
    <authentication>
        <truststore type="Windows-ROOT" provider="SunMSCAPI"/>
    </authentication>
</security-realm>

• type="Windows-MY": This targets the Windows user certificate store where your DNS-named certificate is installed.
• provider="SunMSCAPI": Tells WildFly to use the JDK’s SunMSCAPI provider to access Windows keystores.
• alias="myapp.mydomain.com": Must match the exact alias of your certificate in windows-my (check this with the keytool command below).

2.2 Update the Undertow HTTPS Listener #

Find the <subsystem xmlns="urn:jboss:domain:undertow:..."> section and update the <https-listener> to use your new security realm:

<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-server="default-server" default-virtual-host="default-host">
    <server name="default-server">
        <http-listener name="default" socket-binding="http" redirect-socket="https"/>
        <!-- Link the HTTPS listener to our SSL realm -->
        <https-listener name="https" socket-binding="https" security-realm="SslRealm"/>
    </server>
    <!-- Rest of your Undertow configuration -->
</subsystem>

Step 3: Confirm Your Certificate Alias #

Before starting WildFly, verify that your certificate exists in windows-my and that you’re using the correct alias. Run this command in a command prompt (as the user who will run WildFly):

keytool -list -storetype Windows-MY -provider SunMSCAPI -v

Look for your certificate with the DNS name myapp.mydomain.com and note the Alias name field—this must match exactly what you put in the security realm configuration (case-sensitive!).

Step 4: Optional JVM Parameter Adjustments #

In most cases, the security realm configuration is enough, but if you run into issues with keystore access, you can add these JVM parameters to standalone.conf.bat (Windows):

set "JAVA_OPTS=%JAVA_OPTS% -Djavax.net.ssl.keyStoreType=Windows-MY"
set "JAVA_OPTS=%JAVA_OPTS% -Djavax.net.ssl.trustStoreType=Windows-ROOT"

This ensures the JVM defaults to the Windows keystores for SSL operations.

Step 5: Test the Configuration #

1. Start WildFly normally.
2. Open a browser and navigate to https://myapp.mydomain.com:8443 (adjust the port if you changed the default HTTPS socket binding).
3. Check that the browser recognizes the certificate as valid and shows your DNS name in the certificate details.

Troubleshooting Common Issues #

• Alias not found error: Double-check the alias from the keytool command—even a single typo will break this.
• Permission denied: Ensure the user running WildFly has permission to access the windows-my keystore. If running WildFly as a Windows service, make sure the service account has access to the certificate (you may need to export/import the certificate for the service user).
• Module loading errors: If WildFly complains about missing sun.security.sunMSCAPI, recheck the module directory and module.xml structure from Step 1.

内容的提问来源于stack exchange，提问作者NotaNerd