I've installed keycloak8/wildfly17 built from sources, egrep -i "<wildfly\.[a-z].*\.version>" /usr/local/src/keycloak/pom.xml <wildfly.version>17.0.1.Final</wildfly.version> <wildfly.build-tools.version>1.2.10.Final</wildfly.build-tools.version> <wildfly.core.version>9.0.2.Final</wildfly.core.version> <wildfly.common.version>1.5.1.Final</wildfly.common.version> <wildfly.plugin.version>1.1.0.Final</wildfly.plugin.version> with java -version openjdk version "1.8.0_222" OpenJDK Runtime Environment (IcedTea 3.13.0) (build 1.8.0_222-b10 suse-lp151.333.1-x86_64) OpenJDK 64-Bit Server VM (build 25.222-b10, mixed mode) mvn -version Maven home: /usr/share/java/maven Java version: 1.8.0_222, vendor: IcedTea, runtime: /usr/lib64/jvm/java-1.8.0-openjdk-1.8.0/jre Default locale: en_US, platform encoding: UTF-8 OS name: "linux", version: "5.2.9-26.g0100738-default", arch: "amd64", family: "unix" Following docs at http://docs.wildfly.org/17/WildFly_Elytron_Security.html I've installed/enabled the Elytron wildfly adapter, rm'd refs to the legacy security realm, & updated the https-listener to use Elytron's ssl-context. At this stage, cmd-line access to the mgmt controller works as expected, jboss-cli.sh \ --connect \ --controller=10.0.0.1:9990 \ --properties=/etc/keycloak/jboss.properties \ --user=mgmtuser \ --password=mgmtpass \ --version JBoss Admin Command-line Interface JBOSS_HOME: /opt/keycloak Release: 9.0.2.Final Product: Keycloak 8.0.0-SNAPSHOT JAVA_HOME: /etc/alternatives/java_sdk_openjdk java.version: 12.0.2 java.vm.vendor: Oracle Corporation java.vm.version: 12.0.2+9-suse-lp151.40.1-x8664 os.name: Linux os.version: 5.2.9-25.g71d4424-default Next, I've setup 2way SSL auth for both the mgmt & admin consoles. Checking *browser* access, the secured WF Management console @ https://10.0.0.1:9993 WORKS, and the unsecured URL http://10.0.0.1:9990 correctly REDIRECTS to the above https:// The secured Admin console @ https://10.0.0.1:8443/auth/admin works. Unsecured Admin console access @ *also* (still) works. (Not sure why it's not disabled yet ...) Now, jboss-cli access to the unsecured port, jboss-cli.sh \ --connect \ --controller=10.0.0.1:9990 \ --properties=/etc/keycloak/jboss.properties \ --user=mgmtuser \ --password=mgmtpass \ --version FAILs with Failed to connect to the controller: The controller is not available at 10.0.0.1:990: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+http://10.0.0.1:990. The connection failed: WFLYPRT0053: Could not connect to remote+http://10.0.0.1:990. The connection failed: Connection refused There's apparently no functional redirection, as in the browser. CLI access to the SECURED port ALSO fails, jboss-cli.sh \ --connect \ --controller=remote+https://10.0.0.1:9993 \ -Djavax.net.ssl.trustStore=/etc/keycloak/truststore.client.jks \ --properties=/etc/keycloak/jboss.properties \ --user=mgmtuser \ --password=mgmtpass \ --version Failed to connect to the controller: The controller is not available at 10.0.0.1:9993: java.net.ConnectException: WFLYPRT0053: Could not connect to remote+https://10.0.0.1:9993. The connection failed: WFLYPRT0053: Could not connect to remote+https://10.0.0.1:9993. The connection failed: java.nio.channels.ClosedChannelException Reading these docs, WildFly Client Configuration version 17.0.0.Final, 2019-07-15T01:10:21Z https://docs.wildfly.org/17/Client_Guide.html#Remoting_Client_Configuration doesn't get me any further on solving the problem. What additional elytron (other?) subsystem command 'magic' is needed to get the jboss-cli WF client working on the secured SSL port?