title: SEC_E_INVALID_TOKEN (0x80090308) - Jetty HTTPS servlet
body: <p>I am trying to solve an issue with my Jetty servlet running over HTTPS.</p>
  <p>This is an error in the browser:</p>
  <p><a href="https://i.stack.imgur.com/AvBR0.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/AvBR0.png" alt="enter image description here" /></a></p>
  <p>This is an error in the curl:</p>
  <p><a href="https://i.stack.imgur.com/1svGu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1svGu.png" alt="enter image description here" /></a></p>
  <p>What I did:</p>
  <ol>
  <li><p>I created my Keystore and Truststore as is described here: <a href="https://stackoverflow.com/questions/47434877/how-to-generate-keystore-and-truststore">How to generate keystore and truststore</a> and here <a href="https://serverfault.com/questions/488003/keytool-subjectalternativename">https://serverfault.com/questions/488003/keytool-subjectalternativename</a></p>
  <p>This is my batch script to create Keystore and Truststore:</p>
  </li>
  </ol>
  <pre><code>keytool -keystore keystore.jks -storepass P4ssW0rd -keypass P4ssW0rd -genkey -alias example -validity 365 -dname &quot;CN=example,OU=Example,O=Example,L=Bratislava,ST=Slovakia,C=SK&quot; -ext &quot;SAN=DNS:example.com,DNS:www.example.com,DNS:test.example.com&quot;
  &quot;C:\Program Files\Git\usr\bin\openssl.exe&quot; req -new -x509 -subj &quot;/C=SK/ST=Slovakia/L=Bratislava/O=Example/OU=Example/CN=Root-CA&quot; -keyout ca-key -out ca-cert -days 365 -passout pass:P4ssW0rd
  keytool -keystore truststore.jks -storepass P4ssW0rd -import -alias ca-root -file ca-cert -noprompt
  keytool -keystore keystore.jks -storepass P4ssW0rd -certreq -alias exmaple -file cert-file
  echo [SAN] &gt; extFile
  echo subjectAltName=DNS:example.com,DNS:www.example.com,DNS:test.example.com &gt;&gt; extFile
  &quot;C:\Program Files\Git\usr\bin\openssl.exe&quot; x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out test.pem -days 365 -CAcreateserial -passin pass:P4ssW0rd -extensions SAN -extfile extFile
  keytool -keystore keystore.jks -storepass P4ssW0rd -import -alias ca-root -file ca-cert -noprompt
  keytool -keystore keystore.jks -storepass P4ssW0rd -import -alias metahost -file test.pem
  pause
  </code></pre>
  <ol start="2">
  <li>keystore.jks and truststore.jks were copied to the directory of my project and code was written up to load these files.</li>
  </ol>
  <pre><code>package sk.cood.metahost.server;
  
  import jakarta.servlet.ServletException;
  import jakarta.servlet.annotation.WebServlet;
  import jakarta.servlet.http.HttpServlet;
  import jakarta.servlet.http.HttpServletRequest;
  import jakarta.servlet.http.HttpServletResponse;
  import org.eclipse.jetty.server.*;
  import org.eclipse.jetty.servlet.ServletContextHandler;
  import org.eclipse.jetty.servlet.ServletHolder;
  import org.eclipse.jetty.util.ssl.SslContextFactory;
  
  import java.io.*;
  
  @WebServlet(displayName = &quot;MetaHostServlet&quot;, urlPatterns = { &quot;/*&quot; })
  public class MetaHostServlet extends HttpServlet {
      private static File keyStoreFile;
      private static File trustStoreFile;
  
      public static void main(String[] args) throws Exception {
          loadKeyStores();
  
          Server server = new Server(443);
          ServerConnector connector = createSSLConnector(server, &quot;P4ssW0rd&quot;, &quot;P4ssW0rd&quot;, false);
          server.addConnector(connector);
  
          ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
          context.addServlet(new ServletHolder(new MetaHostServlet()),&quot;/*&quot;);
          context.setContextPath(&quot;/&quot;);
          server.setHandler(context);
  
          server.start();
          server.join();
      }
  
      private static void loadKeyStores() {
          keyStoreFile = new File(&quot;keystore.jks&quot;);
          trustStoreFile = new File(&quot;truststore.jks&quot;);
          if (!keyStoreFile.exists()) {
              throw new RuntimeException(&quot;Key store file does not exist on path '&quot;+keyStoreFile.getAbsolutePath()+&quot;'&quot;);
          }
          if (!trustStoreFile.exists()) {
              throw new RuntimeException(&quot;Trust store file does not exist on path '&quot;+trustStoreFile.getAbsolutePath()+&quot;'&quot;);
          }
      }
  
      private static ServerConnector createSSLConnector(Server server, String keyStorePassword, String trustStorePassword, boolean isClientAuthNeeded) {
          SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
          sslContextFactory.setKeyStorePath(keyStoreFile.getAbsolutePath());
          sslContextFactory.setKeyStorePassword(keyStorePassword);
          sslContextFactory.setTrustStorePath(trustStoreFile.getAbsolutePath());
          sslContextFactory.setTrustStorePassword(trustStorePassword);
          sslContextFactory.setNeedClientAuth(isClientAuthNeeded);
  
          HttpConfiguration https_config = new HttpConfiguration();
          https_config.setSendServerVersion(false);
          https_config.setRequestHeaderSize(512 * 1024);
          https_config.setResponseHeaderSize(512 * 1024);
  
          SecureRequestCustomizer src = new SecureRequestCustomizer();
          https_config.addCustomizer(src);
  
          return new ServerConnector(server, sslContextFactory, new HttpConnectionFactory(https_config));
      }
  
      @Override
      public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
          res.setContentType(&quot;text/html&quot;);
          res.setStatus(HttpServletResponse.SC_OK);
          res.getWriter().println(&quot;&lt;h1&gt;Hello World!&lt;/h1&gt;&quot;);
          res.getWriter().println(&quot;session=&quot; + req.getSession(true).getId());
      }
  }
  </code></pre>
  <ol start="3">
  <li>I started my servlet with jetty and tried to connect to <a href="https://example.com/" rel="nofollow noreferrer">https://example.com/</a> and mentioned error appears.</li>
  </ol>
  <p>I don't know what is wrong in my case, maybe someone more experienced with jetty and certificates will help.</p>
  <p>Thank you so much!</p>