5

I am currently setting up SSL on glassfish and having some issues connecting to the server.

http://javadude.wordpress.com/2010/04/06/getting-started-with-glassfish-v3-and-ssl/

I have followed this guide to set up the certificates which seemed to work great but I couldn't get glassfish to point at the certificates. After some more research I found another guide which said that as well as the changes I made I also had to change all instances of 's1as' in the domain.xml to the alias I gave my certificate. Eventually after some fiddling I changed the following to point to my keystore

-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks

This has partially worked I am able to successfully connect the first few times I try then every successive attempt results in the browser timing out.

Is there a setting I have missed or something that anyone can see I have done incorrectly?

2 Answers 2

4

To set up SSL on a fresh install of Glassfish 3.1

I had numerous issues with 3.0.1 so I would recommend upgrading to 3.1

Following the instructions on the link above, this successfully creates the keystore and certificates.

Change Master password

The master password which is set on Glassfish is also the password which allows access to the SSL certificate store. The default password for Glassfish 3.1 is "changeit", Glassfish 3.0.1 doesnt have a default master password. To change the master password open a command prompt and type

cd C:\glassfish3\bin

asadmin change-master-password

You will be prompted for the default password then asked to enter a new password which should be set to whatever you set your certificate store password to.

Install the certificate

copy the file server.keystore file to C:\glassfish3\glassfish\domains\domain1\config\

In C:\glassfish3\glassfish\domains\domain1\config open the domain.xml document and find all instances of the phrase s1as and replace them with the alias you gave your certificates. There should be approximately 22 changes. In the same document replace all instances of keystore.jks to server.keystore, this is the name of the new keystore created in the javadude instructions above. There should be 2 changes.

Setting up glassfish for SSL

Start Glassfish server by going to Start -> All Programs -> Glassfish server open source edition web profile -> Start application server. This will open a cmd window minimised at the bottom of the screen. Maximise this and enter the Glassfish master password. Open a web browser and enter the URL http://localhost:4848 to access the administration console. Go to Configurations -> Server config -> Network config -> Network listeners -> Http-listener-2. Change the Port to 443 and make sure the enable security box is checked. Click save. On the SSL Tab check the box next to SSL3 and TLS, change the certificate NickName to the alias you set in the previous step (if it hasnt already automatically set) and click save.

4
  • Thank you, thank you, thank you, thank you SOOOO much for this post!
    – Phanto
    Jun 21, 2012 at 18:46
  • This is what I did, but had to go back in the domain.xml and change back the s1as of the admin listener. Leaving it to my new alias "broke" the admin gui.
    – blo0p3r
    Apr 18, 2013 at 18:47
  • excellent. this is the 4.1 master password default. what is the default admin password? or, how do you change the admin password after the master password? I don't see this documented in the glassfish PDF from oracle...
    – Thufir
    Sep 19, 2014 at 3:43
  • @Thufir There is no default admin password. That said, I wish the Glassfish admin panel and asadmin tool had a better way of updating certificates. There are about a dozen instances of the s1as and glassfish-instance cert-nickname's in the config.xml, and you need to get them all.
    – A.Grandt
    Feb 27, 2016 at 5:32
3

If you use the GF as Windows Service you have to save the master password using the following command:

asadmin change-master-password --savemasterpassword true

In other case Windows service will not start again.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .