<?xml version='1.0' encoding='UTF-8'?>
<server xmlns="urn:jboss:domain:4.2">
    ...
	<system-properties>
        <!-- Minimálna dĺžka Diffie-Helman kľúča -->
        <property name="jdk.tls.ephemeralDHKeySize" value="2048"/>
    </system-properties>

	<management>
        <security-realms>
            ...
            <!-- Security realn undertowTLSRealm je potrebné nastaviť iba v prípade konfigurácie HTTPS, zároveň aj pre overovanie cez klientské certifikáty -->
            <security-realm name="undertowTLSRealm">
                <server-identities>
                    <ssl protocol="TLS">
                        <!-- Cesta/heslo ku keystore kde je uložený SSL certifikát pre HTTPS s definovaným aliasom, napr. nb1mgre1.ipesoft-int.sk -->
                        <keystore path="server.jks" relative-to="jboss.server.config.dir" keystore-password="secret" alias="nb1mgre1.ipesoft-int.sk" key-password="secret"/>
                    </ssl>
                </server-identities>
                <!-- Časť "authentication" je potrebné nastaviť iba pre overovanie cez klientské certifikáty -->
                <authentication>
                    <truststore path="client-certificates.jks" relative-to="jboss.server.config.dir" keystore-password="secret"/>
                </authentication>
            </security-realm>
        </security-realms>
        ...
    </management>

	<profile>
 	...
        <subsystem xmlns="urn:jboss:domain:undertow:3.1">
            ...
            <server name="default-server">
                ...               
                <!-- !!! Atribút verify-client je potrebné nastaviť na hodnotu REQUESTED v prípade ak je potrebná autentifikácia cez klientské certifikáty, inak ho netreba meniť -->
                <https-listener name="https" socket-binding="https" security-realm="undertowTLSRealm" verify-client="NOT_REQUESTED"
                                enabled-protocols="TLSv1.2,TLSv1.1"
                                enabled-cipher-suites="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"
                                enable-http2="true"/>
		</subsystem>            
    </profile>

</server>