anchor.diff:  
   Two-Way HTTPS is now enabled for applications.
   
  -[[enable-one-way-ssltls-for-the-management-interfaces-using-the-elytron-subsystem]]
  -=== Enable One-way SSL/TLS for the Management Interfaces Using the
  -Elytron Subsystem
  -
  -[[obtain-or-generate-your-key-store-1]]
  -==== Obtain or generate your key store:
  -
  -Before enabling HTTPS in WildFly, you must obtain or generate the key
  -store you plan on using. To generate an example key store, use the
  -following command.
  -
  -[source, bash]
  -----
  -$ keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore keystore.jks -dname "CN=localhost" -keypass secret -storepass secret
  -----
  -
  -[[create-a-key-store-key-manager-and-server-ssl-context.]]
  -==== Create a key-store, key-manager, and server-ssl-context.
  +[[enable-one-way-ssltls-for-the-management-interfaces]]
  +=== Enable One-way SSL/TLS for the Management Interfaces
  +
  +There are a couple ways to enable one-way SSL/TLS for the management interfaces.
  +
  +[[one-way-ssl-management-interfaces-using-security-command]]
  +==== Using a security command:
  +
  +The _security enable-ssl-management_ command can be used to enable one-way
  +SSL/TLS for the management interfaces. Example of wizard usage:
  +
  +[source,java]
  +----
  +security enable-ssl-management --interactive
  +Please provide required pieces of information to enable SSL:
  +Key-store file name (default management.keystore): keystore.jks
  +Password (blank generated): secret
  +What is your first and last name? [Unknown]: localhost
  +What is the name of your organizational unit? [Unknown]:
  +What is the name of your organization? [Unknown]:
  +What is the name of your City or Locality? [Unknown]:
  +What is the name of your State or Province? [Unknown]:
  +What is the two-letter country code for this unit? [Unknown]:
  +Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct y/n [y]?
  +Validity (in days, blank default): 365
  +Alias (blank generated): localhost
  +Enable SSL Mutual Authentication y/n (blank n): n
  +
  +SSL options:
  +key store file: keystore.jks
  +distinguished name: CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
  +password: secret
  +validity: 365
  +alias: localhost
  +Server keystore file keystore.jks, certificate file keystore.pem and keystore.csr file
  +will be generated in server configuration directory.
  +Do you confirm y/n :y
  +----
  +NB: Once the command is executed, the CLI will reload the server and reconnect to it.
  +
  +HTTPS is now enabled for the management interfaces.
  +
  +[[one-way-ssl-management-interfaces-using-elytron-subsystem-commands]]
  +==== Using Elytron subsystem commands:
  +
  +Elytron subsystem commands can also be used to enable one-way SSL/TLS for the
  +management interfaces.
  +
  +[[configure-key-store]]
  +===== Configure a key-store:
   
   [source, ruby]
   ----
   /subsystem=elytron/key-store=httpsKS:add(path=keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
  - 
  +----
  +
  +*NOTE:* The above command uses _relative-to_ to reference the location
  +of the keystore file. Alternatively, you can specify the full path to
  +the keystore in _path_ and omit _relative-to_.
  +
  +If the keystore file does not exist yet, the following commands can be used to
  +generate an example key pair:
  +
  +[source, ruby]
  +----
  +/subsystem=elytron/key-store=httpsKS:generate-key-pair(alias=localhost,algorithm=RSA,key-size=1024,validity=365,credential-reference={clear-text=secret},distinguished-name="CN=localhost")
  +/subsystem=elytron/key-store=httpsKS:store()
  +----
  +
  +[[create-a-key-manager-and-server-ssl-context]]
  +===== Create a key-manager and server-ssl-context.
  +
  +[source, ruby]
  +----
   /subsystem=elytron/key-manager=httpsKM:add(key-store=httpsKS,credential-reference={clear-text=secret})
    
   /subsystem=elytron/server-ssl-context=httpsSSC:add(key-manager=httpsKM,protocols=["TLSv1.2"])
  
positive.code: example commands above uses _TLSv1.2_.
  
  [[check-and-see-if-the-https-listener-is-configured-to-use-a-legacy-security-realm-for-its-ssl-configuration-1]]
  ==== Check and see if the https-listener is configured to use a legacy
  security realm for its SSL configuration:
  
  [source, ruby]
  ----
  
negative.code: /subsystem=elytron/key-store=httpsKS:add(path=keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS)
  ----
  
  If the keystore file does not exist yet, the following commands can be used to
  generate an example key pair:
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:generate-key-pair(alias=localhost,algorithm=RSA,key-size=1024,validity=365,credential-reference={clear-text=secret},distinguished-name="CN=localhost")
  /subsystem=elytron/key-store=httpsKS:store()
  ----
  
  [[configure-a-key-manager-in-that-references-your-key-store]]
  ===== Configure a key-manager that references your key-store:
  
  [source, ruby]
  ----
  