I've setup my jboss app-server to use SSL. The relevant extract from my config is below. Everything is working ok, however some people have expressed concern over the
keystorePass attribute being in plain text. Is there any way to obfuscate / encrypt this value?
I'm using JBoss 4.2.2.GA (on Red Hat Enterprise Edition, if that makes any difference)
<Connector port="8080" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="/somewhere/some.keystore" keystorePass="somePassword" keyAlias="tomcat"/>
Edit, To get away from the security by obscurity approach, an alternative to obfuscating this would be to not supply it at all and have tomcat prompt for the p/w on startup. However as far as I know this isn't supported. Can anyone confirm or deny this?