Replaced old client cert generation instructions with instructions to…

… use a CLI script instead of keytool

helloworld-mutual-ssl/README.adoc

@@ -28,74 +28,13 @@ include::../shared-doc/system-requirements.adoc[leveloffset=+1]
 include::../shared-doc/use-of-jboss-home-name.adoc[leveloffset=+1]
 
 [[set_up_client_keystore_using_java_keytool]]
-== Set Up the Client Keystore Using Java Keytool
-
-. Open a terminal and navigate to the {productName} server `configuration` directory:
-+
-[source,subs="+quotes,attributes+",options="nowrap"]
-----
-$ cd __{jbossHomeName}__/standalone/configuration/
-----
+== Set Up the Client Keystore
 
 . Create the client certificate, which is used to authenticate against the server when accessing a resource through TLS.
 +
-[source,options="nowrap"]
-----
-$>keytool -genkey -keystore client.keystore -storepass secret -validity 365 -keyalg RSA -keysize 2048 -storetype pkcs12
-
-What is your first and last name?
-    [Unknown]:  quickstartUser
-What is the name of your organizational unit?
-    [Unknown]:  Sales
-What is the name of your organization?
-    [Unknown]:  My Company
-What is the name of your City or Locality?
-    [Unknown]:  Sao Paulo
-What is the name of your State or Province?
-    [Unknown]:  Sao Paulo
-What is the two-letter country code for this unit?
-    [Unknown]:  BR
-Is CN=quickstartUser, OU=Sales, O=My Company, L=Sao Paulo, ST=Sao Paulo, C=BR correct?
-    [no]:  yes
-----
-
-. Export the client certificate and create a truststore by importing this certificate:
-+
-[source,options="nowrap"]
-----
-$>keytool -exportcert -keystore client.keystore  -storetype pkcs12 -storepass secret -keypass secret -file client.crt
-$>keytool -import -file client.crt -alias quickstartUser -keystore client.truststore -storepass secret
-
-Owner: CN=quickstartUser, OU=Sales, O=My Company, L=Sao Paulo, ST=Sao Paulo, C=BR
-Issuer: CN=quickstartUser, OU=Sales, O=My Company, L=Sao Paulo, ST=Sao Paulo, C=BR
-Serial number: 7fd95ce4
-Valid from: Mon Jul 24 16:14:03 BRT 2017 until: Tue Jul 24 16:14:03 BRT 2018
-Certificate fingerprints:
-     MD5:  87:41:C5:CC:E6:79:91:F0:9D:90:AD:9E:DD:57:81:80
-     SHA1: 55:35:CA:B0:DC:DD:4F:E6:B8:9F:45:4B:4B:98:93:B5:3B:7C:55:84
-     SHA256: 0A:FC:93:B6:25:5A:74:42:B8:A1:C6:5F:69:88:72:7F:27:A9:81:B0:17:0C:F1:AF:3D:DE:B7:E5:F1:69:66:4B
-     Signature algorithm name: SHA256withRSA
-     Version: 3
-
-Extensions:
-
-#1: ObjectId: 2.5.29.14 Criticality=false
-SubjectKeyIdentifier [
-KeyIdentifier [
-0000: 95 84 BE C6 32 BB 2B 13   4C 7F 5D D4 C4 C8 22 12  ....2.+.L.]...".
-0010: CB 09 39 09                                        ..9.
-]
-]
-
-Trust this certificate? [no]:  yes
-Certificate was added to keystore
-----
-
-. Export client certificate to pkcs12 format
-+
-[source,options="nowrap"]
+[source,subs="+quotes,attributes+",options="nowrap"]
 ----
-$>keytool -importkeystore -srckeystore client.keystore -srcstorepass secret -destkeystore clientCert.p12 -srcstoretype PKCS12 -deststoretype PKCS12 -deststorepass secret
+$ __{jbossHomeName}__/bin/jboss-cli.sh --connect --file=configure-client-cert.cli
 ----
 
 . The certificate and keystore are now properly configured.
@@ -185,15 +124,15 @@ If it is configured correctly, you should be asked to trust the server certifica
 [[import_the_client_certificate_into_your_browser]]
 == Import the Client Certificate into Your Browser
 
-Before you access the application, you must import the _clientCert.p12_, which holds the client certificate, into your browser.
+Before you access the application, you must import the _client.keystore.P12_, which holds the client certificate, into your browser.
 
 [[import_the_client_certificate_into_google_chrome]]
 === Import the Client Certificate into Google Chrome
 
 . Click the Chrome menu icon (3 dots) in the upper right on the browser toolbar and choose *Settings*. This takes you to `link:`chrome://settings/`.
 . Click on *Privacy and security* and then on *Security*.
 . Scroll down to the *Advanced* section and on the *Manage certificates* screen, select the *Your Certificates* tab and click on the *Import* button.
-. Select the *clientCert.p12* file. You will be prompted to enter the password: `secret`.
+. Select the *client.keystore.P12* file. You will be prompted to enter the password: `secret`.
 . The client certificate is now installed in the Google Chrome browser.
 
 [[import_the_client_certificate_into_mozilla_firefox]]
@@ -203,7 +142,7 @@ Before you access the application, you must import the _clientCert.p12_, which h
 . A new window will open. Click on *Privacy & Security* and scroll down to the *Certificates* section.
 . Click the *View Certificates* button.
 . A new window will open. Select the *Your Certificates* tab and click the *Import* button.
-. Select the *clientCert.p12* file. You will be prompted to enter the password: `secret`.
+. Select the *client.keystore.P12* file. You will be prompted to enter the password: `secret`.
 . The certificate is now installed in the Mozilla Firefox browser.
 
 // Build and Deploy the Quickstart
@@ -255,14 +194,16 @@ include::../shared-doc/restore-standalone-server-configuration-manual.adoc[level
 
 == Remove the keystores and certificates created for this quickstart
 
-. Open a terminal and navigate to the {productName} server `configuration` directory:
+. Run the CLI script for restoring client cert configuration: 
 +
 [source,subs="+quotes,attributes+",options="nowrap"]
 ----
-$ cd __{jbossHomeName}__/standalone/configuration/
+$ __{jbossHomeName}__/bin/jboss-cli.sh --connect --file=restore-client-cert.cli
 ----
++
+NOTE: For Windows, use the `__{jbossHomeName}__\bin\jboss-cli.bat` script.
 
-. Remove the `clientCert.p12`, `client.crt`, `client.keystore`, and `client.truststore` files that
+. Remove the `client.keystore.P12`, `clientCert.crt`, `client.keystore`, and `client.truststore` files that
 were generated for this quickstart.
 
 [[remove_the_client_certificate_from_your_browser]]

helloworld-mutual-ssl/configure-ssl.cli

@@ -4,8 +4,7 @@
 batch
 
 # Add the keystore and trust manager configuration in the elytron subsystem
-/subsystem=elytron/key-store=qsTrustStore:add(path=server.truststore,relative-to=jboss.server.config.dir,type=JKS,credential-reference={clear-text=secret})
-/subsystem=elytron/trust-manager=qsTrustManager:add(key-store=qsTrustStore)
+/subsystem=elytron/trust-manager=qsTrustManager:add(key-store=serverTS)
 
 # Update the default server-ssl-context to reference the new trust-manager and require client auth
 /subsystem=elytron/server-ssl-context=applicationSSC:write-attribute(name=trust-manager, value=qsTrustManager)

helloworld-mutual-ssl/restore-configuration.cli

@@ -12,7 +12,6 @@ batch
 
 # Remove the trust manager and keystore configuration from the elytron subsystem
 /subsystem=elytron/trust-manager=qsTrustManager:remove
-/subsystem=elytron/key-store=qsTrustStore:remove
 
 # Run the batch commands
 run-batch