Hi Dieter,
I use undertow http core only so there is only single page applications served by my server. Here is an example on how to serve REST API as well as Single Page Application like Angular or React.
The certificate will work for both web UI and your REST API but I cannot confirm if it works for war file because it is on top of servlet container which I never used. For performance reason, I would recommended to get rid of servlet container as it is dozens times slower than core http.
Take a look at this page you can see Light-Java and Spring-Boot with Undertow embedded performance difference. Of course, Spring added a lot of overhead so it is not exactly Undertow core http vs Undertow servlet container.
Even you have tls enabled, you might still need additional authentication/authorization to protect your resources and basic auth is one of them. Here is an example to use basic auth.
Also, for you REST API, OAuth2 should be leveraged to protect your endpoint. Here is an article that I wrote for that topic.
Thanks,
Steve