[ https://issues.jboss.org/browse/WFWIP-101?page=com.atlassian.jira.plugin.... ] Jan Stourac updated WFWIP-101: ------------------------------ Steps to Reproduce: # get and unzip WildFly # go to WildFly home and prepare keystores: {code} keytool -genkeypair -alias default-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/default.keystore.jks -dname "CN=default" -keypass secret -storepass secret keytool -genkeypair -alias asterisk-cert -keyalg RSA -keysize 1024 -validity 365 -keystore standalone/configuration/asterisk.keystore.jks -dname "CN=asterisk" -keypass secret -storepass secret {code} # start server, connect to CLI and configure SNI mappings: {code} /subsystem=elytron/key-store=defaultKS:add(path=default.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-store=asteriskKS:add(path=asterisk.keystore.jks,relative-to=jboss.server.config.dir,credential-reference={clear-text=secret},type=JKS) /subsystem=elytron/key-manager=defaultKM:add(key-store=defaultKS,algorithm="SunX509",credential-reference={clear-text=secret}) /subsystem=elytron/key-manager=asteriskKM:add(key-store=asteriskKS,algorithm="SunX509",credential-reference={clear-text=secret}) /subsystem=elytron/server-ssl-context=defaultSSC:add(key-manager=defaultKM,protocols=["TLSv1.2"]) /subsystem=elytron/server-ssl-context=asteriskSSC:add(key-manager=asteriskKM,protocols=["TLSv1.2"]) /subsystem=elytron/server-ssl-sni-context=sniSSC:add(default-ssl-context=defaultSSC, host-context-map={".*\\.example\\.com"=asteriskSSC}) batch /subsystem=undertow/server=default-server/https-listener=https:undefine-attribute(name=security-realm) /subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=ssl-context,value=sniSSC) run-batch reload {code} # check how SNI works e.g. via OpenSSL s_client tool: {code} openssl s_client -showcerts -connect localhost:8443 -servername first-sublevel.example.com openssl s_client -showcerts -connect localhost:8443 -servername second-sublevel.first-sublevel.example.com {code} was: # configure Undertow HTTPS listener with Elytron server-ssl-sni-context with SNI mapping {code} .*\\.example\\.com {code} # perform handshake with SNIHostName _twosublevel.onesublevel.example.com_ -- This message was sent by Atlassian Jira (v7.12.1#712002)