Geoserver and moving to HTTPS - jetty

Question

I've installed a Platform Indepednant Binary version Geoserver (http://geoserver.org/release/2.16.2/) successfully. It's been a while using it an no real problems. I now want to use this version of Geoserver for an OpenLayers website (that uses GeoLocation) but that requires all the component parts that use HTTP to use HTTPS...Geoserver is the last server I have that needs to be migrated.
I've looked online and there seems to be a lot of info on moving Geoserver to HTTPS but it doesn't all tie up with my installation. Some examples talk about server.xml files (which my installation doesn't have) and updating an apache conf file (/etc/apache2/sites-avaiable/smallmelo-le-ssl.conf) which I don't have either so I'm struggling to get instructions on my particular version of Geoserver. The docs state that it's running on a Jetty servlet. Does anyone have any documentation or links on how to configure https?
Progress!! So my installation is using Jetty. I've setup the keystore correctly with a valid certificate. I've updated the start.ini file to reflect the location of the keystore and password but...when I try to run geoserver I get:
ERROR : No module found to provide ssl for https{enabled}
I do not have an SSL.MOD module in the modules folder of my jetty installation. I did dig out a module (ssl) from https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.2.13.v20150730/ but I now get:
java.lang.IllegalStateException: No constructor class org.eclipse.jetty.server.ServerConnector([],{}) in file:/C:/Program%20Files/Geoserver/geoserver-2.16.2/etc/jetty-https.xml
I've struggled to find out how to update this file and add what is needed. Problem is I'm not a java expert so I don't want to just randomly copy someone elses config settings.

Answer 1

This is a simple case of finding a Jetty tutorial and following it, GeoServer doesn't care about https.
However, I should warn you that the reason you can't find much help in the GeoServer documentation is because you shouldn't run the platform independent binary in a production environment. This is the reason that the documentation expects a server.xml (part of tomcat) and assumes that you are behind an Apache2 or Nginx web server that is designed to handle ssl.

Answer 2

Both of the warning messages you mention come from bit rot in the Jetty configuration files on the GeoServer repository. You figured out that the ssl.mod file is missing, and adding it manually solves that issue.
The second error java.lang.IllegalStateException: No constructor class comes from a mix of Jetty version config files. The jetty-https.xml file that is in the GeoServer 2.16 repo is from Jetty 9.4, and the jetty-ssl.xml is from Jetty 9.2. At some point between those version, the location of the constructor <Configure id="Server" class="org.eclipse.jetty.server.Server"> was moved from jetty-https to jetty-ssl. It was not updated correctly in the GeoServer repo so there is a set of mismatched xml files.
I solved this by copying the jetty-https.xml file from 9.2 to match the 9.2 version of jetty-ssl.xml included with Geoserver. You could use the more current jetty files that match what Geoserver is running on, but make sure you copy all of them, ssl.mod, jetty-https.xml, jetty-ssl.xml, and jetty-ssl-context.xml.

Answer 3

Ok, just wanted to share this in case it was helpful. It is a bit brief but hopefully will be of use. Please note: My setup used a legitimate GoDaddy DNS/SSL Certificate so that may be a limiter for some and force you to use a self-signed certificate.
Thank you to Ian Turton who created the 'aha' moment :)
I used the following youtube video to get Tomcat and Geoserver installed: https://www.youtube.com/watch?v=RyCFKGm4NSw
Firstly, once I had Tomcat running (I used port 8081 as 8080 was already in use). Please be aware when I installed to port 8081 it didn't update the server.xml file, so I had to manually open it up and change
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
to
<Connector port="8081" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
and then restart Tomcat.
I used a legitimate PFX file I downloaded from GoDaddy. I already have an SSL certificate/DNS setup with them so it was just a question of requesting a PFX file.
Secondly, I imported my PFX using JAVA installed from AdoptOpenJDK. I went to the commandline, navigated to the AdoptOpenJDK bin folder (which has a keytool.exe application). I then ran this command:
keytool -importkeystore -srckeystore c:/temp/mygodaddycert.pfx -srcstoretype pkcs12 -destkeystore c:/temp/mycert.jks -deststoretype JKS
When prompted for the password for the enter source password I got that from GoDaddy and then I used my own, completely different, password for the JKS file. I then copied my JKS file to ./conf/certs folder (I created the certs folder)
Thirdly, I added this to my /conf/server.xml file:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150"
SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLS"
keystoreFile="conf/certs/mycert.jks"
keystorePass="<your_jks_password_when_registering_with_keytool>"
/>
I restart Tomcat...
Then I used my DNS from GoDaddy to connect to the instance: https://myXYZ.de:8443/ and voila Tomcat running on SSL with no certificate errors. Since Geoserver was installed. I can just add geoserver to the end: https://myXYZ.de:8443/geoserver and voila number 2.