32

I am trying to configure SSL on my Jetty.

I read this: http://docs.codehaus.org/display/JETTY/How+to+configure+SSL and created a key store.

Then, I jumped directly to section 4. But where is this configuration file I should configure Jetty?

I tried to serach for jetty.xml, but there is no such on my computer...

Elnur Abdurrakhimov
  • 44,533
  • 10
  • 148
  • 133
Yura
  • 347
  • 1
  • 3
  • 7

6 Answers6

40

I had a lot of problems making it work but I finally foud out how to make it happend. I'm using ubuntu 10.04 with java 7. It may be possible to do it under windows but all the comands lines are bash commands, maybe possible to do the same with cigwin/mingw

I used Jetty 8.1.8. Download it from codehaus and choose the .tar.gz file for linux (.zip for windows).

Unzip the file in any directory you wish, this will be your {jetty} home folder for the sake of this article/answer.

Go to the {jetty}/etc directory.

Execute all the following command lines in order. Whenever a password is asked, input the same password all the time. The passwords are used to protect the key file, the key store and the certificate itself. Sometimes, a password will be asked to unlock the key store or to use a generated key. Once you will understand what everything is and how to use the passwords correctly, you may change those passwords when you feel ready (safer for production use). Otherwise, input the requested informations when asked.

openssl genrsa -des3 -out jetty.key
openssl req -new -x509 -key jetty.key -out jetty.crt
keytool -keystore keystore -import -alias jetty -file jetty.crt -trustcacerts
openssl req -new -key jetty.key -out jetty.csr
openssl pkcs12 -inkey jetty.key -in jetty.crt -export -out jetty.pkcs12
keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore keystore

Now you have to edit {jetty}/etc/jetty-ssl.xml and configure your password to match the one you used during certificate generation. If you want to obfuscate your password, go back to the command line. Go tho your {jetty} home directory and execute the following:

java -cp lib/jetty-util-8.1.8.v20121106.jar org.eclipse.jetty.util.security.Password "{PASSWORD}"

Change {PASSWORD} for your actual password then past the obfuscated password, including the "OBF:" in all password fields found in jetty-ssl.xml. Note that a password obfuscated like that is hard to read for humans but easily unobfiscated programmatically. It just prevent developpers to know the password when they edit the file. All configuration files should be secured properly and their accesses be as restrictive as possible.

Edit {jetty}/start.ini and uncomment the line #etc/jetty-ssl.xml (just remove the #).

Start jetty:

java -jar start.jar

Now contact your server at: https://localhost:8443

Done!

Note that this answer is a quick way to enable SSL with jetty. To make it secure for production, you have to read some more on the subject.

talonmies
  • 70,661
  • 34
  • 192
  • 269
formixian
  • 1,549
  • 16
  • 25
  • 2
    At the last step I got the error: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded The solution at followinmg link worked for me: http://stackoverflow.com/questions/9236939/java-keytool-giving-final-block-not-properly-padded #Remove files created rm jetty.pkcs12 jetty.csr keystore jetty.crt jetty.key #Repeat all steps with first step modified to add 2048 at the end as shown below: openssl genrsa -des3 -out jetty.key 2048 Also, suggest adding comments to each of the steps to explain what it is doing. Thanks for a good solution. – Farrukh Najmi May 22 '13 at 15:10
  • recent jetty versions apparently don't use start.ini. Instead run this: sudo echo "/etc/jetty/jetty-ssl.xml" >> /etc/jetty/jetty.conf – s_t_e_v_e Aug 10 '13 at 15:49
  • In your example, which of the files would be the `truststore`? Would it be `jetty.pkcs12`? – Michael Black Jul 03 '19 at 06:16
  • @MichaelBlack, none of them. jetty.pkcs12 is the public key (https://en.wikipedia.org/wiki/PKCS_12). The thrust store is somewhere in the JAVA_HOME. You can override that by providing a value when launching the java application with -Djavax.net.ssl.trustStore. See https://docs.oracle.com/cd/E19830-01/819-4712/ablqw/index.html for details. – formixian Jul 18 '19 at 18:04
24

Answer updated after more experience with keystores. I assure you this solution works perfectly with intermediate certificates (29/07/2015).

Note: PEM format means a readable file, certificates start with ---BEGIN CERTIFICATE--- and private keys start with -----BEGIN PRIVATE KEY----- line.

Here's an easy step by step guide. Start with an empty directory.
Skip to Step 2 if you have private key (PEM encoded .key)
Skip to Step 3 if you have certificate signing request (PEM encoded .csr)
Skip to Step 4 if you have your certificate (PEM encoded .crt or .pem)

  1. Prepare (password-less) private key. 

    openssl genrsa -des3 -passout pass:1 -out domain.pass.key 2048
openssl rsa -passin pass:1 -in domain.pass.key -out domain.key
rm domain.pass.key

  2. Prepare certificate signing request (CSR). We'll generate this using our key. Enter relevant information when asked. Note the use of -sha256, without it, modern browsers will generate a warning. 

    openssl req -key domain.key -sha256 -new -out domain.csr

  3. Prepare certificate. Pick one:

    a) Sign it yourself

    openssl x509 -req -days 3650 -in domain.csr -signkey domain.key -out domain.crt

    b) Send it to an authority

    Your SSL provider will supply you with your certificate and their intermediate certificates in PEM format.

  4. Add to trust chain and package it in PKCS12 format. First command sets a keystore password for convenience (else you'll need to enter password a dozen times). Set a different password for safety. 

    export PASS=LW33Lk714l9l8Iv

    Pick one:

    a) Self-signed certificate (no need for intermediate certificates) 

    openssl pkcs12 -export -in domain.crt -inkey domain.key -out domain.p12 -name domain -passout pass:$PASS
keytool -importkeystore -deststorepass $PASS -destkeypass $PASS -destkeystore domain.keystore -srckeystore domain.p12 -srcstoretype PKCS12 -srcstorepass $PASS -alias domain

    b) Need to include intermediate certificates

    Download intermediate certificates and concat them into one file. The order should be sub to root. 

    cat sub.class1.server.ca.pem ca.pem > ca_chain.pem

    Use a -caname parameter for each intermediate certificate in chain file, respective to the order they were put into the chain file. 

    openssl pkcs12 -export -in domain.crt -inkey domain.key -out domain.p12 -name domain -passout pass:$PASS -CAfile ca_chain.pem -caname sub1 -caname root -chain
keytool -importkeystore -deststorepass $PASS -destkeypass $PASS -destkeystore domain.keystore -srckeystore domain.p12 -srcstoretype PKCS12 -srcstorepass $PASS -alias domain

    Important note: Although keytool -list will only list one entry and not any intermediate certificates, it will work perfectly.

  5. Configure jetty.

    Move domain.keystore file to JETTY_HOME/etc/.

    Pick one:

    a) You're using new start.ini style configuration (Jetty 8+): 

    jetty.keystore=etc/domain.keystore
jetty.truststore=etc/domain.keystore
jetty.keystore.password=LW33Lk714l9l8Iv
jetty.keymanager.password=LW33Lk714l9l8Iv
jetty.truststore.password=LW33Lk714l9l8Iv

    b) You're using old style configuration with .xml files (you should upgrade to new style!):

    Edit JETTY_HOME/etc/jetty-ssl.xml file and change the part below. Replace password parts to match your password. We don't define KeyManagerPassword because our key has no password. 

    <Configure id="Server" class="org.eclipse.jetty.server.Server">
  <New id="sslContextFactory" class="org.eclipse.jetty.http.ssl.SslContextFactory">
    <Set name="KeyStore"><Property name="jetty.home" default="." />/etc/keystore</Set>
    <Set name="KeyStorePassword">LW33Lk714l9l8Iv</Set>
    <Set name="TrustStore"><Property name="jetty.home" default="." />/etc/keystore</Set>
    <Set name="TrustStorePassword">LW33Lk714l9l8Iv</Set>
  </New>
  <Call name="addConnector">...</Call>
</Configure>

    Edit start.ini file to include jetty-ssl.xml file.

  6. (Re)start jetty.

Note that this keystore file can also be used with other containers like Tomcat. Good luck!

bekce
  • 3,782
  • 29
  • 30
  • I followed all of these steps but get ```curl localhost:8443/ curl: (52) Empty reply from server``` The 8080 call still works fine. Any idea what I missed? – Usman Ismail Sep 23 '14 at 14:48
2

Just bought a cert from godaddy for mere $6/year. Great deal while it lasts. Here are the steps I followed to set it up on Amazon EC2/Ubuntu/Jetty based on these sites and Jean-Philippe Gravel's answer.

http://docs.codehaus.org/display/JETTY/How+to+configure+SSL

http://community.xmatters.com/docs/DOC-1228#.UgWsI1MU7lc

keytool -keystore keystore -alias jettykey -genkey -keyalg RSA

Note that "First and last name" must be your FQDN (without http://). On my first attempt I had dutifully put my first and last name, but godaddy has good warnings and rejected it.

Generate a CSR file for Godaddy:

keytool -certreq -alias jetty -keystore keystore -file jetty.csr

Submit this in the Godaddy form to create the certificate, including the BEGIN/END "NEW CERTIFICATE REQUEST".

(Godaddy requires you to verify its your site. There a couple methods for this and since I bought the domain name via a proxy, I found it easiest and quickest to verify by hosting an html page generated by godaddy.)

Download the zip containing both certificate and intermediary certificate from godaddy. There is a list of server types to choose from. I choose "other". Then combine cert with intermediary cert.

cat mydomain.com.crt gd_bundle.crt > certchain.txt

export my private key

keytool -importkeystore -srckeystore keystore -destkeystore intermediate.p12 -deststoretype PKCS12
openssl pkcs12 -in intermediate.p12 -out jettykey.pem -nodes

combine private key and certificate

openssl pkcs12 -export -inkey jettykey.pem -in certchain.txt -out jetty.pkcs12

import pkcs12 cert (alias becomes 1)

keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore keystore

(I backed up the keystore then deleted the original key. I did this while troubleshooting and this may or may not be required by Jetty.)

keytool -delete  -keystore keystore -alias jettykey

sudo cp keystore /usr/share/jetty/etc/

sudo vi /usr/share/jetty/etc/jetty-ssl.xml

Modify your.store.password, your.key.password, and your.trust.password accordingly. If you want to obfuscate it, use

java -cp /usr/share/jetty/lib/jetty.jar:/usr/share/jetty/lib/jetty-util.jar org.mortbay.jetty.security.Password <your.password>

Indicate to Jetty to load the jetty-ssl.xml file.

sudo echo "/etc/jetty/jetty-ssl.xml" >> /etc/jetty/jetty.conf

sudo /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443

(Also modify Amazon EC2 security group to allow 443)

sudo service jetty start
s_t_e_v_e
  • 2,496
  • 3
  • 31
  • 35
2

A default configuration file for Jetty and is located at $JETTY_HOME/etc/jetty.xml

If you are using maven's jetty plugin you will need to specify ssl keystore details in your pom.xml file. See this question for details

Community
  • 1
  • 1
Sorantis
  • 14,496
  • 5
  • 31
  • 37
  • What we have here is a configuration file. We start server wich reads the pcjetty.xml configuration file and then configures and starts jetty (as part of our Java code) – Yura Oct 25 '10 at 11:23
  • I tried adding this: http://wiki.eclipse.org/Jetty/Reference/SSL_Connectors section to pcjetty.xml file but it throws exception on startup. I dont really understant what this section does and it should be configured... Could you pls help? – Yura Oct 25 '10 at 11:25
  • if you don't see jetty.xml file in /etc directory, try creating one, perhaps it will solve your problem – Sorantis Oct 25 '10 at 17:09
  • I have anotherfile (created by us) pcjetty.xml. This is the configuration file jetty reads from when I load it from code. However, adding the section – Yura Oct 26 '10 at 08:23
  • 8443 – Yura Oct 26 '10 at 08:24
  • etc... does not help, there are errors. I was looking for a detaled tutorial/explanaition how to configure the jetty.xml (or pcjetty.xml in my case) – Yura Oct 26 '10 at 08:25
1

If you happen to work with Jetty 9.3 then you should change configuration in start.d/ssl.ini:

jetty.sslContext.keyStorePath=mystore.jks
jetty.sslContext.keyStorePassword=X
jetty.sslContext.keyManagerPassword=X
jetty.sslContext.trustStorePath=mystore.jks
jetty.sslContext.trustStorePassword=X

Where:

  • mystore.jks is your store generated with the keytool
  • X is your password in plain text (I would recommend skipping obfuscation as it only gives you false security)

The store is exactly the same as you would generate for Tomcat. Even if you used different Java version to generate the keystore that should not be a problem.

Nux
  • 9,276
  • 5
  • 59
  • 72
  • It is always needed to enter a password when using ssl on jetty? (I was about to try importing a keypair into my jks, so i still need to enter the password for the sslContext as described?) – Gobliins Mar 29 '17 at 12:08
  • Jetty has to know the password. Otherwise it wouldn't be able to use the certificates for encryption. – Nux Mar 30 '17 at 12:33
  • Sorry this is an old thread, but running into a similar question atm. I have dropwizard (1.3-rc6) - I think the latest version of it. It ships with Jetty, where do you edit these files? I downloaded Jetty locally with brew and know were the `start.d` and other files are, but how does that affect the Jetty implementation pulled in with the dropwizard framework dependency – DJ2 Apr 09 '18 at 20:12
  • Well `start.d` is where your configuration should be. Example configuration files are in the original jetty installation in demo base... Not sure if they differ much between jetty versions/editions. – Nux Apr 10 '18 at 21:08
0

When trying on Windows with Jetty as Maven plugin the following steps can help:

pom.xml

<plugin>
    <groupId>org.mortbay.jetty</groupId>
    <artifactId>jetty-maven-plugin</artifactId>
    <version>8.1.11.v20130520</version>
    <configuration>
        <scanIntervalSeconds>10</scanIntervalSeconds>
        <webApp>
            <contextPath>/yourappcontext</contextPath>
        </webApp>
        <connectors>
            <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
                <port>9090</port>
                <maxIdleTime>1</maxIdleTime>
            </connector>
            <connector implementation="org.eclipse.jetty.server.ssl.SslSocketConnector">
                <port>9443</port>
                <keystore>src/test/resources/keystore</keystore>
                <keyPassword>123456</keyPassword>
                <password>123456</password>
            </connector>
        </connectors>
    </configuration>
</plugin>

Generate key/certificate using the JDK tool keytool:

keytool -keystore keystore -alias jetty -genkey -keyalg RSA

This command will generate a file keystore which we need to put at the following (or what ever you like until it is configured in the keystore element) path src/test/resources/keystore.

Kalle Richter
  • 8,008
  • 26
  • 77
  • 177
Kalher
  • 3,613
  • 2
  • 24
  • 34