make wildfly listen on port 443 not 8443

Question

so I have added a SSL certificate to my wildfly 9 and it's working, but I want to configure my standalone.xml to listen to https on port 443 not on port 8443 as the default configuration, so when I update the value ${jboss.https.port:8443} to ${jboss.https.port:443} it generate an error. this what I have in my standalone.xml :

<server name="default-server">
            <http-listener name="default" socket-binding="http" redirect-socket="https"/>
            <https-listener name="httpsServer" socket-binding="https" security-realm="ApplicationRealm"/>
            <host name="default-host" alias="localhost">
                <location name="/" handler="welcome-content"/>
                <location name="/images" handler="ImagesDirHandler"/>
                <filter-ref name="server-header"/>
                <filter-ref name="x-powered-by-header"/>
            </host>
</server>

<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
    <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
    <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
    <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
    <socket-binding name="http" port="${jboss.http.port:8080}"/>
    <socket-binding name="https" port="${jboss.https.port:8443}"/>
    <socket-binding name="txn-recovery-environment" port="4712"/>
    <socket-binding name="txn-status-manager" port="4713"/>
    <outbound-socket-binding name="mail-smtp">
        <remote-destination host="localhost" port="25"/>
    </outbound-socket-binding>
</socket-binding-group>

Answer 1

Please, provide more accurate details about your environment and errors.

I had similar needs like you. The users access our system trough a network where the only requests availables are on port 80 or 443. Than, when a costumer calls the system on port 80, wildfly redirects to port 8443 and the user cannot connect to the system. The solution was to make wildfly redirect to port 443 instead 8443. Follow some instruction for all looking for help in this issue:

1. In case of a linux based operational system, ports up to 1024 are available to bind only with root privilegies.
2. It isn't a great idea run wildfly or any other web/app server with root privilegies in a production oriented server.
3. In other hands, try to run wildfly with a 'regular' user directly bind to port 443 or 80 generates permission denied like errors.

The solution for the problem I described above was to bind wildfly to ports 8080/8443 (without root privilegies) and ask the operational system to redirect traffic from port 80 to port 8080 and port 443 to port 8443. After it, config wildfly to redirect http requests to https requests on port 443 instead 8443.

So, assuming wildfly is working with http on port 8080 and https on port 8443 in a Linux based OS as service:

1) Stop wildfly: sudo service wildfly stop

2) Add iptables commands in the startup /etc/init.d/wildfly script like:

if [ $launched -eq 0 ]; then
        log_warning_msg "$DESC hasn't started within the timeout allowed"
        log_warning_msg "please review file \"$JBOSS_CONSOLE_LOG\" to see the status of the service"
    else 
        iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
        iptables -t nat -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443

    fi

PS: You add a rule on a table called "nat", from man pages of iptables:

nat:

This table is consulted when a packet that creates a new connection is encountered.

So, if you have requested https://localhost:443 before the rule creation, the connection wal already created, so the nat table is not applied. Try from a new device.

Where $launched is a bash variable to represent the state of wildfly

2) In the standalone.xml, create an additional socket-binding entry:

<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
    <socket-binding name="management-http" interface="management" port="${jboss.management.http.port:9990}"/>
    <socket-binding name="management-https" interface="management" port="${jboss.management.https.port:9993}"/>
    <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
    <socket-binding name="http" port="${jboss.http.port:8080}"/>
    <socket-binding name="https" port="${jboss.https.port:8443}"/>
    <socket-binding name="https-external" port="443"/>
    <socket-binding name="txn-recovery-environment" port="4712"/>
    <socket-binding name="txn-status-manager" port="4713"/>
   ...

</socket-binding-group>

Take attention to new tag entry <socket-binding name="https-external" port="443"/>

3) Change the http-listener to redirect to https-external instead https:

<http-listener name="default" socket-binding="http" redirect-socket="https-external" max-header-size=...

Where the change is redirect-socket="https-external"

4) Restart wildfly: sudo service wildfly start

After wildfly starts, verify the console.log file to see any errors report.

Thus, if your web.xml section assure confidential transport:

....
<security-constraint>
    ...
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
...

Wildfly will redirect the requests on port 80 or 8080 to directly to port 443 instead 8443.

Obs: It is a good idea to make backup copies of your /etc/init.d/wildfly script and standalone.xml file configuration before make any changes on them.