[id='configuring-server-keystores_{context}']
= Configuring {brandname} Server Keystores
Add keystores to {brandname} Server and configure it to present SSL/TLS certificates that verify its identity to clients.
If a security realm contains TLS/SSL identities, it encrypts any connections to {brandname} Server endpoints that use that security realm.

.Prerequisites

* Create a keystore that contains certificates, or certificate chains, for {brandname} Server.

{brandname} Server supports the following keystore formats: JKS, JCEKS, PKCS12,
BKS, BCFKS, and UBER.

[IMPORTANT]
====
In production environments, server certificates should be signed by a trusted Certificate Authority, either Root or Intermediate CA.
====

.Procedure

. Add the keystore that contains SSL/TLS identities for {brandname} Server to the `{server_home}/server/conf` directory.
. Add a `server-identities` definition to the {brandname} Server security realm.
. Specify the keystore file name with the `path` attribute.
. Provide the keystore password and certificate alias with the `keystore-password` and `alias` attributes.

.{brandname} Server keystore configuration
[source,xml,options="nowrap",subs=attributes+]
----
include::config_examples/server_ssl_identity_truststore.xml[]
----

.Next steps

Configure clients with a trust store so they can verify SSL/TLS identities for {brandname} Server.

[role="_additional-resources"]
.Additional resources
* link:{hotrod_docs}#configuring-hotrod-encryption_hotrod-client-configuration[Configuring Hot Rod client encryption]
