title: WildFly 9 enable client certificate authentication
body: <p>I want to enable client certificate authentication on my web app running on a WildFly 9 server.</p>
  
  <p>For that, I configured my application with the following elements:</p>
  
  <p>I created a server keystore, a client keystore. From them, I exported a self-signed certificate which I included in my server truststore.</p>
  
  <p>My standalone.xml file contains those parts:</p>
  
  <pre><code>...
  &lt;management&gt;
      &lt;security-realms&gt;
          &lt;security-realm name="my-realm"&gt;
              &lt;server-identities&gt;
                  &lt;ssl&gt;
                      &lt;keystore path="server.keystore" relative-to="jboss.server.config.dir" keystore-password="password"/&gt;
                  &lt;/ssl&gt;
              &lt;/server-identities&gt;
              &lt;authentication&gt;
                  &lt;jaas name="my-domain"/&gt;
              &lt;/authentication&gt;
          &lt;/security-realm&gt;
      &lt;/security-realms&gt;
  &lt;/management&gt;
  ...
  &lt;subsystem xmlns="urn:jboss:domain:security:1.2"&gt;
      &lt;security-domains&gt;
          &lt;security-domain name="my-domain" cache-type="default"&gt;
              &lt;authentication&gt;
                  &lt;login-module code="Remoting" flag="optional"&gt;
                      &lt;module-option name="password-stacking" value="useFirstPass"/&gt;
                  &lt;/login-module&gt;
                  &lt;login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required"&gt;
                      &lt;module-option name="usersProperties" value="${jboss.server.config.dir}/app-users.properties"/&gt;
                      &lt;module-option name="rolesProperties" value="${jboss.server.config.dir}/app-roles.properties"/&gt;
                      &lt;module-option name="password-stacking" value="useFirstPass"/&gt;
                  &lt;/login-module&gt;
              &lt;/authentication&gt;
          &lt;/security-domain&gt;
      &lt;/security-domains&gt;
  &lt;/subsystem&gt;
  ...
  &lt;subsystem xmlns="urn:jboss:domain:undertow:2.0"&gt;
      &lt;buffer-cache name="default"/&gt;
      &lt;server name="default-server"&gt;
          &lt;http-listener name="default" socket-binding="http" redirect-socket="https"/&gt;
          &lt;https-listener name="https" socket-binding="https" security-realm="my-realm"/&gt;
  
          &lt;host name="default-host" alias="localhost"&gt;
              &lt;location name="/" handler="welcome-content"/&gt;
              &lt;filter-ref name="server-header"/&gt;
              &lt;filter-ref name="x-powered-by-header"/&gt;
          &lt;/host&gt;
      &lt;/server&gt;
      &lt;servlet-container name="default"&gt;
          &lt;jsp-config/&gt;
          &lt;websockets/&gt;
      &lt;/servlet-container&gt;
      &lt;handlers&gt;
          &lt;file name="welcome-content" path="${jboss.home.dir}/welcome-content"/&gt;
      &lt;/handlers&gt;
      &lt;filters&gt;
          &lt;response-header name="server-header" header-name="Server" header-value="WildFly/9"/&gt;
          &lt;response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/&gt;
      &lt;/filters&gt;
  &lt;/subsystem&gt;
  ...
  </code></pre>
  
  <p>My web.xml file contains this:</p>
  
  <pre><code>...
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Admin Resource&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  ...
  &lt;login-config&gt;
      &lt;auth-method&gt;CLIENT-CERT&lt;/auth-method&gt;
      &lt;realm-name&gt;my-realm&lt;/realm-name&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;role-name&gt;my-role&lt;/role-name&gt;
  &lt;/security-role&gt;
  ...
  </code></pre>
  
  <p>My jboss-web.xml contains:</p>
  
  <pre><code>&lt;security-domain&gt;my-domain&lt;/security-domain&gt;
  </code></pre>
  
  <p>I also added the following arguments on my JDK:</p>
  
  <pre><code>-Djavax.net.debug=ssl:handshake
  -Djavax.net.ssl.trustStore=[WILDFLY_HOME]\\standalone\\configuration\\server.truststore
  -Djavax.net.ssl.trustStorePassword=password
  </code></pre>
  
  <p>Then I tried to access to my web application using a web browser at the URL <code>http://localhost:8080/my-app-web/</code>. I am redirected to <code>https://localhost:8443/my-app-web/</code> and I can reached the content of the page even if the browser does not contain the client certificate.</p>
  
  <p>Can you tell me what is wrong with my configuration ?</p>