WildFly / JBoss

Automate TLS certificate enrollment and renewal on WildFly and JBoss EAP with the Horizon Client.

The Horizon Client automates the full TLS certificate lifecycle on WildFly (and JBoss EAP). The certificate is stored in a Java keystore (JKS or PKCS#12) and WildFly is restarted automatically after each enrollment or renewal.

Prerequisites

WildFly or JBoss EAP installed and running
Horizon Client installed and configured (see Installation & Configuration)
A PKI connector configured in Horizon. See Configure SwissSign MPKI.
A certificate profile configured in Horizon. See Certificate Profiles.
An automation policy configured in Horizon. See Automation Policies.
Root or sudo access on the server

Setting up TLS on a new WildFly server

Use init when WildFly does not yet have an HTTPS listener configured:

sudo horizon-cli automate init --target=wildfly --automation-policy=<policy>

To set up HTTPS on a non-standard port:

sudo horizon-cli automate init --target=wildfly --automation-policy=<policy> --port=<port>

Taking control of an existing certificate

Use enroll when WildFly is already serving HTTPS. The client detects the existing keystore from the WildFly configuration, re-enrolls the certificate under the automation policy, and updates the keystore:

sudo horizon-cli automate enroll --target=wildfly --automation-policy=<policy>

If WildFly uses a keystore password that cannot be read from the configuration file, provide it explicitly:

sudo horizon-cli automate enroll --target=wildfly --automation-policy=<policy> --keystore-password=<password>

To preview what the client finds without making any changes:

sudo horizon-cli automate enroll --target=wildfly --automation-policy=<policy> --analyze-only

Scheduled renewal

Once enrolled, run routine to check for and perform renewals:

sudo horizon-cli automate routine

Create a cron job to run this automatically:

sudo horizon-cli automate create-periodic-task

The period can be any value between 1h and 24h. The default is 6h. To remove the cron job:

sudo horizon-cli automate remove-periodic-task

Certificate storage and backup

The certificate is stored in a Java keystore (JKS or PKCS#12), which the Horizon Client detects from the WildFly configuration. On each renewal:

The keystore is updated with the new certificate.
The previous keystore is backed up in /opt/horizon/cert/backup/.
The original keystore from before Horizon took management is always preserved.

To see which certificates are currently managed and find their IDs:

horizon-cli automate list

IDs follow the format <target>-*:<port>, for example wildfly-*:8443.

To remove a certificate from Horizon management and restore the original, pass the ID from automate list:

sudo horizon-cli automate remove <id> --restore

For trigger-based workflows and other advanced automation configuration, refer to the Evertrust Horizon documentation.