title: jetty 9: setting up the most basic SSL / https
body: <p><strong>NOTE:  If you want to see the behaviour of this demo app, just go to www.collaborativepowernowinternational.us.  Here, select the testssl.PersonController, and you may create a person.  Then go and edit the person, where the SSL channel is designated, which will give a redirect loop.</strong></p>
  
  <p>It seems like with Jetty 9 more configuration items went into the start.ini file, I have version 9.05.</p>
  
  <p>In order to test the most basic SSL/https, I am uncommenting the following lines in start.ini:</p>
  
  <pre><code>#===========================================================
  # SSL Context
  # Create the keystore and trust store for use by
  # HTTPS and SPDY
  #-----------------------------------------------------------
  jetty.keystore=etc/keystore
  jetty.keystore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4
  jetty.keymanager.password=OBF:1u2u1wml1z7s1z7a1wnl1u2g
  jetty.truststore=etc/keystore
  jetty.truststore.password=OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4
  jetty.secure.port=8443
  etc/jetty-ssl.xml
  
  #===========================================================
  # HTTPS Connector
  # Must be used with jetty-ssl.xml
  #-----------------------------------------------------------
  jetty.https.port=8443
  etc/jetty-https.xml
  </code></pre>
  
  <p>No other Jetty configuration changes.  I then built the most basic Grails app (has a Person class) where I set certain controller actions to secure, which works fine on my development machine using an older built in Jetty version (that Grails includes).  This is done simply by including spring-security-core and then adding the following lines to a configuration file:</p>
  
  <pre><code>grails.plugins.springsecurity.secureChannel.definition = [
    '/person/list': 'REQUIRES_INSECURE_CHANNEL',
    '/person/delete/**': 'REQUIRES_SECURE_CHANNEL',
    '/person/edit/**': 'REQUIRES_SECURE_CHANNEL',
    '/person/show': 'REQUIRES_INSECURE_CHANNEL'
  ]
  
  grails.plugins.springsecurity.portMapper.httpPort=80
  grails.plugins.springsecurity.portMapper.httpsPort=443
  </code></pre>
  
  <p>When I access the person/edit action I get a redirect loop in the browser (using deployed WAR file to Jetty 9 on dedicated CentOs 6 machine).  This is using the provided keystore that comes with Jetty 9, just uncommenting the lines in start.ini to use it.</p>
  
  <p>The main Jetty SSL configuration page I'm reading is <a href="http://www.eclipse.org/jetty/documentation/current/configuring-ssl.html#configuring-sslcontextfactory" rel="noreferrer">here</a>.  What isn't clear to me is, is updating the start.ini file enough?  If not, how exactly does one add the lines in jetty-https.xml described in this previous link, i.e. the lines:</p>
  
  <pre><code> &lt;New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory"&gt;
      &lt;Set name="KeyStorePath"&gt;&lt;Property name="jetty.home" default="." /&gt;/etc/keystore&lt;/Set&gt;
      &lt;Set name="KeyStorePassword"&gt;OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4&lt;/Set&gt;
      &lt;Set name="KeyManagerPassword"&gt;OBF:1u2u1wml1z7s1z7a1wnl1u2g&lt;/Set&gt;
      &lt;Set name="TrustStorePath"&gt;&lt;Property name="jetty.home" default="." /&gt;/etc/keystore&lt;/Set&gt;
      &lt;Set name="TrustStorePassword"&gt;OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4&lt;/Set&gt;
   &lt;/New&gt;
  </code></pre>
  
  <p>Not sure how to add them, but they also seem a duplicate of the start.ini file lines above.</p>
  
  <p>Can you please help help me get the most basic Jetty SSL running?   Thanks much. </p>
  
  <hr>
  
  <p>If not familiar with Grails, one can simply download it, then create a domain class -- there is a command line option for this.  Then give it fields String firstName, String lastName.   Then there are commands to generate a controller and views for it -- this is all totally automatic.  Then one adds the plugin, spring-security-core.  In chapter 16/17 of this doc and as I have shown, when lists which controller actions are secure, such as person/edit.</p>