SSL Certificate Expiration

The TLS/SSL certificate used for SSL in JBoss is stored in APPSRV_HOME/standalone/configuration/keystore/keystore.jks. The default validity time for the SSL certificate is two years. When this expire, you must generate a new one.

You can do this through the RA Web by:

1. In EJBCA RA Web, select Search → End Entities and search for user tomcat.

2. Select Edit on the found user and set the Enrollment code to the same as httpsserver.password in your conf/web.properties and Status to New.

3. Open up a command line in EJBCA_HOME and run:

   bin/ejbca.sh batch

4. Copy EJBCA_HOME/p12/tomcat.jks to APPSRV_HOME/standalone/configuration/keystore/keystore.jks, or run

   ant deploy-keystore

   
   Ant deploy will do some other things as well, so if you are not sure, just copy the file.

5. Restart JBoss.

You can also do everything using the CLI:

1. Run the following in the CLI:

   bin/ejbca.sh ra setendentitystatus tomcat 10

   bin/ejbca.sh ra setclearpwd tomcat <password from httpsserver.password>

   bin/ejbca.sh batch tomcat

   cp p12/tomcat.jks $APPSRV_HOME/standalone/configuration/keystore/keystore.jks

2. Restart JBoss.

A small convenience ant target is present which can simplify the process and save some typing (it's running the above three ejbca.sh commands in succession):

1. Run the following in the CLI:

   ant renew-keystore

   cp p12/tomcat.jks $APPSRV_HOME/standalone/configuration/keystore/keystore.jks

2. Restart JBoss.