anchor.diff:  [[enable-one-way-ssltls-for-applications]]
   === Enable One-way SSL/TLS for Applications
   
  -In WildFly, you can use the Elytron subsystem, along with the Undertow
  -subsystem, to enable HTTPS for deployed applications.
  -
  -[[obtain-or-generate-your-key-store]]
  -==== Obtain or generate your key store:
  -
  -Before enabling HTTPS in WildFly, you must obtain or generate the
  -keystore you plan on using. To generate an example keystore:
  -
  -[source, bash]
  -----
  -$ keytool -genkeypair -alias localhost -keyalg RSA -keysize 1024 -validity 365 -keystore /path/to/keystore.jks -dname "CN=localhost" -keypass secret -storepass secret
  -----
  +There are a couple ways to enable one-way SSL/TLS for deployed applications.
  +
  +[[one-way-ssl-applications-using-security-command]]
  +==== Using a security command:
  +
  +The _security enable-ssl-http-server_ command can be used to enable one-way
  +SSL/TLS for deployed applications. Example of wizard usage:
  +
  +[source,java]
  +----
  +security enable-ssl-http-server --interactive
  +Please provide required pieces of information to enable SSL:
  +Key-store file name (default default-server.keystore): keystore.jks
  +Password (blank generated): secret
  +What is your first and last name? [Unknown]: localhost
  +What is the name of your organizational unit? [Unknown]:
  +What is the name of your organization? [Unknown]:
  +What is the name of your City or Locality? [Unknown]:
  +What is the name of your State or Province? [Unknown]:
  +What is the two-letter country code for this unit? [Unknown]:
  +Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct y/n [y]?
  +Validity (in days, blank default): 365
  +Alias (blank generated): localhost
  +Enable SSL Mutual Authentication y/n (blank n): n
  +
  +SSL options:
  +key store file: keystore.jks
  +distinguished name: CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
  +password: secret
  +validity: 365
  +alias: localhost
  +Server keystore file keystore.jks, certificate file keystore.pem and keystore.csr file
  +will be generated in server configuration directory.
  +Do you confirm y/n: y
  +----
  +NB: Once the command is executed, the CLI will reload the server.
  +
  +HTTPS is now enabled for applications.
  +
  +[[one-way-ssl-applications-using-elytron-subsystem-commands]]
  +==== Using Elytron subsystem commands:
  +
  +You can also use the Elytron subsystem, along with the Undertow subsystem, to
  +enable HTTPS for deployed applications.
   
   [[configure-a-key-store-in-wildfly]]
  -==== Configure a key-store in WildFly:
  +===== Configure a key-store in WildFly:
   
   [source, ruby]
   ----
  
positive.code: ----
  
  [[reload-the-server-1]]
  ==== Reload the server
  
  [source, ruby]
  ----
  reload
  ----
  
  [[configure-your-client-to-use-the-client-certificate]]
  ==== Configure your client to use the client certificate
  
  You need to configure your client to present the trusted client
  
negative.code: trusted certificate into the browser's trust store.
  
  Two-way SSL/TLS is now enabled for the management interfaces.
  
  
  [[keystore-manipulation-operations]]
  === KeyStore manipulation operations
  
  It is possible to perform various KeyStore manipulation operations on an
  Elytron key-store resource using the management CLI.
  
  [[generate-key-pair]]
  ==== Generate a key pair
  The _generate-key-pair_ command generates a key pair and wraps the resulting
  public key in a self-signed X.509 certificate. The generated private key and
  self-signed certificate will be added to the KeyStore.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:generate-key-pair(alias=example,algorithm=RSA,key-size=1024,validity=365,credential-reference={clear-text=secret},distinguished-name="CN=www.example.com")
  ----
  
  [[generate-certificate-signing-request]]
  ==== Generate a certificate signing request
  The _generate-certificate-signing-request_ command generates a PKCS #10
  certificate signing request using a PrivateKeyEntry from the KeyStore. The
  generated certificate signing request will be output to a file.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:generate-certificate-signing-request(alias=example,path=server.csr,relative-to=jboss.server.config.dir,distinguished-name="CN=www.example.com",extensions=[{critical=false,name=KeyUsage,value=digitalSignature}],credential-reference={clear-text=secret})
  ----
  
  [[import-certificate]]
  ==== Import a certificate or certificate chain
  The _import-certificate_ command imports a certificate or certificate chain
  from a file into an entry in the KeyStore.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:import-certificate(alias=example,path=/path/to/certificate_or_chain/file,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},trust-cacerts=true)
  ----
  
  [[export-certificate]]
  ==== Export a certificate
  The _export-certificate_ command exports a certificate from an entry in the
  KeyStore to a file.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:export-certificate(alias=example,path=serverCert.cer,relative-to=jboss.server.config.dir,pem=true)
  ----
  
  [[change-alias]]
  ==== Change an alias
  The _change-alias_ command moves an existing KeyStore entry to a new alias.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:change-alias(alias=example,new-alias=newExample,credential-reference={clear-text=secret})
  ----
  
  [[store-changes]]
  ==== Store changes made to key-stores
  The _store_ command persists any changes that have been made to the file that
  backs the KeyStore.
  
  [source, ruby]
  ----
  /subsystem=elytron/key-store=httpsKS:store()
  ----
  
  [[using-an-ldap-key-store]]
  === Using an ldap-key-store
  