#
# Copyright The WildFly Authors
# SPDX-License-Identifier: Apache-2.0
#

security.abstract-ssl-enable.option.interactive.description=\
Use this option to have CLI to prompt user for the information required to setup one way or \
two way SSL configuration.\n\
Warning: This option is only available if the elytron subsystem supports advanced key-store\
 manipulation.

security.abstract-ssl-enable.option.key-store-name.description=\
Mandatory if no --key-store-path is used. This is the name of an existing key-store resource.\
Completion exposes existing key-stores.

security.abstract-ssl-enable.option.key-store-name.value=key-store name

security.abstract-ssl-enable.option.key-store-password.description=\
Mandatory if --key-store-path is used. The key-store password.

security.abstract-ssl-enable.option.key-store-password.value=password

security.abstract-ssl-enable.option.key-store-path.description=\
Mandatory if no --key-store-name is used. The key-store absolute \
(if --key-store-path-relative-to is not used) or relative (if not used) path.

security.abstract-ssl-enable.option.key-store-path.value=key-store path

security.abstract-ssl-enable.option.key-store-path-relative-to.description=\
Optional, to be used with the --key-store-path option. Makes the provided path \
relative to a system property (eg:jboss.server.config.dir).

security.abstract-ssl-enable.option.key-store-path-relative-to.value=system property

security.abstract-ssl-enable.option.key-store-type.description=\
Optional, to be used with the --key-store-path option. The type of the key-store. \
By default JKS is used. Completion exposes the main supported types.

security.abstract-ssl-enable.option.key-store-type.value=type\

security.abstract-ssl-enable.option.new-key-manager-name.description=\
Optional, name of the created key-manager resource. By default a name is computed \
based on the key-store path or name.

security.abstract-ssl-enable.option.new-key-manager-name.value=key-manager name

security.abstract-ssl-enable.option.new-key-store-name.description=\
Optional, to be used with the --key-store-path option. Name of the created key-store \
resource. By default a name is computed based on the key-store path.

security.abstract-ssl-enable.option.new-key-store-name.value=key-store name

security.abstract-ssl-enable.option.new-ssl-context-name.description=\
Optional, name of the created ssl-context resource. By default a name is computed \
based on the key-store path or name.

security.abstract-ssl-enable.option.new-ssl-context-name.value=ssl-context name

security.abstract-ssl-enable.option.new-trust-manager-name.description=\
Optional, name of the created trust-manager resource. By default a name is computed \
based on the trust-store path or name.

security.abstract-ssl-enable.option.new-trust-manager-name.value=trust-manager name\

security.abstract-ssl-enable.option.new-trust-store-name.description=\
Optional, name of the created trust-store resource. By default a name is computed \
based on the trust-store path.

security.abstract-ssl-enable.option.new-trust-store-name.value=trust-store name

security.abstract-ssl-enable.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.abstract-ssl-enable.option.no-trusted-certificate-validation.description=\
By default the imported certificate is validated, use this option to disable validation.

security.abstract-ssl-enable.option.trusted-certificate-path.description=\
Path to the client certificate to import. If the certificate is already imported \
in a trust-store, use the option --trust-store-name.\n\
Warning: This option is only available if the elytron subsystem supports advanced key-store\
 manipulation.

security.abstract-ssl-enable.option.trusted-certificate-path.value=certificate path

security.abstract-ssl-enable.option.trust-store-file-name.description=\
Optional, the name of the generated trust-store file. By default management.truststore is used.\n\
Warning: This option is only available if the elytron subsystem supports advanced key-store\
 manipulation.

security.abstract-ssl-enable.option.trust-store-file-name.value=file name

security.abstract-ssl-enable.option.trust-store-file-password.description=\
Optional, generated trust-store file password. By default a password is generated.\n\
Warning: This option is only available if the elytron subsystem supports advanced key-store\
 manipulation.

security.abstract-ssl-enable.option.trust-store-file-password.value=password

security.abstract-ssl-enable.option.trust-store-name.description=\
The name of an existing trust-store that contains the client certificate. Completion \
 proposes existing trust-store.

security.abstract-ssl-enable.option.trust-store-name.value=name

security.abstract-ssl-enable.option.validate-trusted-certificate.description=\
Optional, by default, the imported certificate is validated, use this option to disable validation.\n\
Warning: This option is only available if the elytron subsystem supports advanced key-store\
 manipulation.

security.abstract-ssl-enable.option.lets-encrypt.description=\
Optional, use this option to obtain certificate from Let's Encrypt server.

security.abstract-ssl-enable.option.ca-account.value=certificate authority account

security.abstract-ssl-enable.option.ca-account.description=\
Optional, can be used with the --lets-encrypt parameter. \
  Allows to re-use certificate authority account already created by the security command. \
  Therefore prompts for info about account key store and certificate authority account will be skipped.\
  It assumes that you have already agreed to Let's encrypt TOS.

security.disable-ssl-management.description=\
Disable SSL for a given management interface. By default the 'http-interface' is the \
target of this command.\n\
Once SSL has been disabled, CLI reloads the server (start-mode=<the mode the current \
server is running>) and attempts to reconnect.\n\
\n\
TIPS: Use 'echo-dmr security ssl-disable-management <options>' in order to \
visualize the composite request that would be sent to disable SSL.

security.disable-ssl-management.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload and have CLI to reconnect to the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.disable-ssl-management.option.management-interface.description=\
Optional, the name of the management interface for which SSL will be disabled. By default 'http-interface' \
is the target of this command. Completion proposes the set of enabled interfaces.

security.disable-ssl-management.option.management-interface.value=management interface

security.enable-ssl-management.option.http-secure-socket-binding.description=\
Optional, the name of the secure socket-binding to use with the management http-interface. \
By default 'https' is use.

security.enable-ssl-management.option.http-secure-socket-binding.value=socket binding

security.enable-ssl-management.option.management-interface.description=\
Optional, the name of the management interface to apply SSL to. By default http-interface \
is the interface in use.

security.enable-ssl-management.option.management-interface.value=management interface

security.enable-ssl-management.description=\
Enable SSL for a given management interface. By default 'http-interface' is the \
target of this command. Other management interface can be targeted thanks to the \
--management-interface option.\n\
\n\
This command offers 3 ways to setup SSL.\n\
\n\
1) --interactive, the command prompts user for the information needed to enable SSL. \
NB: The server certificate, certificate signing request file, server key-store, \
server trust-store (if any) will be generated in the server configuration directory.\n\
\n\
2) By using the path of an existing key-store \
file (--key-store-path option)\n\
\n\
3) By using an existing key-store already added in the server \
(--key-store-name option).\n\
\n\
This command tries to limit the set of created resources by identifying existing resources \
that can be reused to full-fill the security requirements.\n\
\n\
TIPS: Use 'echo-dmr security ssl-enable-management [<options>]' in order to \
visualize the composite request that would be sent to enable SSL.


security.enable-ssl-http-server.description=\
Enable https for an undertow http server. This command is only available if the undertow \
subsystem is present. By default the 'default-server' is the target of \
this command. Other server name can be specified thanks to the --server-name option.\
\n\
This command offers 3 ways to setup SSL.\n\
\n\
1) --interactive, the command prompts user for the information needed to enable SSL. \
NB: The server certificate, certificate signing request file, server key-store, \
server trust-store (if any) will be generated in the server configuration directory.\n\
\n\
2) By using the path of an existing key-store \
file (--key-store-path option)\n\
\n\
3) By using an existing key-store already added in the server \
(--key-store-name option).\n\
\n\
This command tries to limit the set of created resources by identifying existing resources \
that can be reused to full-fill the security requirements.\n\
\n\
TIPS: Use 'echo-dmr security ssl-enable-http-server [<options>]' in order to \
visualize the composite request that would be sent to enable SSL.

security.enable-ssl-http-server.option.server-name.description=\
Optional, the name of the http server to apply SSL to.

security.enable-ssl-http-server.option.server-name.value=server name

security.enable-ssl-http-server.option.no-override-security-realm.description=\
Optional, by default the legacy security-realm attached to the HTTPS server will be erased. \
Use this option to not erase it. Only applies to server configuration that supports deprecated security-realm \
to secure the HTTPS listener.

security.enable-ssl-http-server.option.add-https-listener.description=\
Optional, by default the command expects that the 'https' HTTPS listener exists. If that is not the case, \
use this option to add an HTTPS listener named with the '--https-listener-name' option.

security.enable-ssl-http-server.option.override-ssl-context.description=\
Optional, in order to override any SSL context already set on the HTTPS listener. Default to false.

security.enable-ssl-http-server.option.https-listener-name.description=\
Optional, the name of the HTTPS listener to apply SSL to. Default to 'https'.

security.enable-ssl-http-server.option.https-listener-name.value=HTTPS listener name

security.enable-ssl-http-server.option.https-listener-socket-binding-name.description=\
Optional, the name of the socket binding used when adding a new HTTPS listener. Default to 'https'.

security.enable-ssl-http-server.option.https-listener-socket-binding-name.value=HTTPS listener socket binding name

security.disable-ssl-http-server.description=\
Disable https for the undertow http server. This command is only available if the undertow subsystem \
is present. By default the 'default-server' is the target of \
this command. Other server name can be specified thanks to the --server-name option.\
\n\
TIPS: Use 'echo-dmr security ssl-disable-http-server <options>' in order to \
visualize the composite request that would be sent to disable SSL.

security.disable-ssl-http-server.option.no-reload.description=\
Optional, by default the server is reloaded once the configuration changes have been applied. \
In order to not reload the server, use this option.\n\
NB: reload is done in start-mode=<the mode the current server is running>.

security.disable-ssl-http-server.option.server-name.description=\
Optional, the name of the http server. By default 'default-server' is used.

security.disable-ssl-http-server.option.server-name.value=server name

security.disable-ssl-http-server.option.remove-https-listener.description=\
Optional, set this option to remove the HTTPS listener.

security.disable-ssl-http-server.option.https-listener-name.description=\
Optional, the name of the HTTPS listener to remove. Default to 'https'.

security.disable-ssl-http-server.option.https-listener-name.value=HTTPS listener name

security.disable-ssl-http-server.option.default-server-ssl-context.description=\
Optional, the name of the server SSL context to set if the HTTPS listener is not removed. Defaults to \
'applicationSSC'.

security.disable-ssl-http-server.option.default-server-ssl-context.value=SSL server context name
