Reenviar certificado con optional

 Más de una vez, al configurar el SSL para un location de apache, al indicar el el certificado era opcional, no se estaba enviando al back end. 

Para configurar correctamente esta situación se empleará la siguiente configuración:

<Location /web/sede/mi-carpeta>
      SSLVerifyClient optional
      SSLVerifyDepth 3
      SSLOptions +StrictRequire +OptRenegotiate +ExportCertData +StdEnvVars
      SSLRenegBufferSize 10486000
     
      
      RewriteCond %{SSL:SSL_CLIENT_VERIFY} !=SUCCESS
      RewriteRule .? - [F]
      ErrorDocument 403 http://miPaginaDeError.html
  </Location>

javax.net.ssl.SSLProtocolException: handshake alert: unrecognized_name

This error occurs when you are trying to connect to a https direction and the host name does not match de server name returned in the response message.

javax.net.ssl.SSLProtocolException: handshake alert:  unrecognized_name
        sun.security.ssl.ClientHandshaker.handshakeAlert(ClientHandshaker.java:1292)
        sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1952)
        sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
        sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
        sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
        sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
        sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
        sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1300)
        sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
        org.apache.xerces.impl.XMLEntityManager.setupCurrentEntity(XMLEntityManager.java:986)
        org.apache.xerces.impl.XMLVersionDetector.determineDocVersion(XMLVersionDetector.java:143)
        org.apache.xerces.parsers.XML11Configuration.parse(XML11Configuration.java:802)
        org.apache.xerces.parsers.XML11Configuration.parse(XML11Configuration.java:768)
        org.apache.xerces.parsers.XMLParser.parse(XMLParser.java:108)
        org.apache.xerces.parsers.DOMParser.parse(DOMParser.java:230)
        org.apache.xerces.jaxp.DocumentBuilderImpl.parse(DocumentBuilderImpl.java:285)
        com.ibm.wsdl.xml.WSDLReaderImpl.getDocument(WSDLReaderImpl.java:2101)
        com.ibm.wsdl.xml.WSDLReaderImpl.readWSDL(WSDLReaderImpl.java:2303)
        com.ibm.wsdl.xml.WSDLReaderImpl.readWSDL(WSDLReaderImpl.java:2335)
        org.apache.cxf.wsdl11.WSDLManagerImpl.loadDefinition(WSDLManagerImpl.java:263)
        org.apache.cxf.wsdl11.WSDLManagerImpl.getDefinition(WSDLManagerImpl.java:206)
        org.apache.cxf.wsdl11.WSDLServiceFactory.<init>(WSDLServiceFactory.java:98)
        org.apache.cxf.jaxws.ServiceImpl.initializePorts(ServiceImpl.java:204)
        org.apache.cxf.jaxws.ServiceImpl.<init>(ServiceImpl.java:149)
        org.jboss.wsf.stack.cxf.client.ProviderImpl$JBossWSServiceImpl.<init>(ProviderImpl.java:509)
        org.jboss.wsf.stack.cxf.client.ProviderImpl.createServiceDelegate(ProviderImpl.java:204)
        javax.xml.ws.Service.<init>(Service.java:57)
        javax.xml.ws.Service.create(Service.java:687)
        org.springframework.remoting.jaxws.LocalJaxWsServiceFactory.createJaxWsService(LocalJaxWsServiceFactory.java:137)
        org.springframework.remoting.jaxws.JaxWsPortClientInterceptor.prepare(JaxWsPortClientInterceptor.java:334)
        org.springframework.remoting.jaxws.JaxWsPortClientInterceptor.invoke(JaxWsPortClientInterceptor.java:484)
        org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
        org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
        com.sun.proxy.$Proxy118.getPerfilesUsuario(Unknown Source)

Using apache, you have to configure propertly the virtual host. Set ServerName and ServerAlias to match de domain name.

<VirtualHost _default_:443>

(..)

ServerName jboss01.localdomain:443
ServerAlias jboss01.localdomain

(...)

SSLCertificateFile /etc/httpd/keystores/server_jboss01.cer
SSLCertificateKeyFile /etc/httpd/keystores/server_jboss01.key
SSLCertificateChainFile /etc/httpd/keystores/server_cas.pem

(...)
</VirtualHost>

In this case, the URL should be https://jboss01.localdomain/xxxxxx.

Note, in the server certificate, the Common Name (CN) must be also jboss01.localdomain

JBoss CLI enable SSL

Domain Mode, profile full-ha:

/profile=full-ha/subsystem=web/connector=HTTPS/:add(socket-binding=https,scheme=https,protocol=HTTP/1.1,secure=true)
/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration:add(name=https)

/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-key-file,value="/opt/jboss/domain/configuration/certificates/jboss_identity(1234).jks")
/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=password,value="1234")
/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=key-alias,value="jboss-identity")
/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=keystore-type,value=jks)

/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-file,value="/opt/jboss/domain/configuration/certificates/jboss_truststore(1234).jks")
/profile=full-ha/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=truststore-type,value=jks)


/host=master/system-property="javax.net.ssl.trustStore":add(value="/opt/jboss/domain/configuration/certificates/jboss_truststore(1234).jks")
/host=master/system-property="javax.net.ssl.trustStorePassword":add(value="1234")

Standalone Mode:

/subsystem=web/connector=HTTPS/:add(socket-binding=https,scheme=https,protocol=HTTP/1.1,secure=true)
/subsystem=web/connector=HTTPS/ssl=configuration:add(name=https)

/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-key-file,value="/opt/jboss/standalone/configuration/certificates/jboss_identity(1234).jks")
/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=password,value="1234")
/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=key-alias,value="jboss-identity")
/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=keystore-type,value=jks)

/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=certificate-file,value="/opt/jboss/standalone/configuration/certificates/jboss_truststore(1234).jks")
/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=truststore-type,value=jks)


/system-property="javax.net.ssl.trustStore":add(value="/opt/jboss/standalone/configuration/certificates/jboss_truststore(1234).jks")
/system-property="javax.net.ssl.trustStorePassword":add(value="1234")

Note. You can replace "/opt/jboss" (my jboss home dir) with "${jboss.home.dir}"