Enable HTTPS on GeoServer

Here’s a short tutorial on installing SSL Certificate for Jetty Server that comes bundled with GeoServer.

Disclaimer: The following steps are performed and tested in Windows OS.

Generate PFX Certificate

You can create self-signed certificate and export it as a pfx file in Powershell as administrator. For this, run the following command:

$cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname <domain name>

For my example:

$cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname g.umd.me.uk

$pwd = ConvertTo-SecureString -String 'password' -Force -AsPlainText

$path = ‘cert:\localMachine\my\’ + $cert.thumbprint

Export-PfxCertificate -cert $path -FilePath m:\certs\powershellcert.pfx -Password $pwd

For my example:

Export-PfxCertificate -cert $path -FilePath C:\certs\powershellcert.pfx -Password $pwd

Install the certificate by simply double-clicking the newly generated pfx file on Windows. Or, use the following command (Import-PfxCertificate (pki) | Microsoft Learn):

$mypwd = Get-Credential -UserName 'Enter password below' -Message 'Enter password below'

$params = @{
	FilePath = 'C:\certs\powershellcert.pfx'
	CertStoreLocation = 'cert:\localmachine\my'
	Password = $mypwd.Password
}		

Import-PfxCertificate @params

Generate KEYSTORE file

Keystore file is required by Jetty for SSL configuration. Hence, convert the PFX file to JKS Keystore and then install it on the Jetty Server that comes with GeoServer.

• Go to ‘bin’ folder of JDK and run the following command in cmd:

keytool -importkeystore -srckeystore C:\certs\powershellcert.pfx -srcstoretype pkcs12 -destkeystore C:\certs\keystore -deststoretype JKS

Import keystore from PFX certificate file

**Tip: Use the same password that you used to generate the pfx file

• Now, execute the following command to verify if the created keystore is a PrivateKeyEntry.

keytool -list -keystore C:\certs\keystore -storepass password

List Keystore

• Copy the generated keystore to %GEOSERVER_HOME%\etc\keystore

Configure Jetty Server

• Open the start.ini in %GEOSERVER_HOME% and copy the following to after — module=http

#SSL
--module=ssl
jetty.ssl.port=8443
jetty.sslContext.keyStorePath=etc/keystore
jetty.sslContext.trustStorePath=etc/keystore
jetty.sslContext.keyStorePassword=password
jetty.sslContext.keyManagerPassword=password
jetty.sslContext.trustStorePassword=password
--module=https
jetty.httpConfig.securePort=8443

• Download the jetty-distribution file (it must be the same version as in the geoserver — geoserver 2.21 and 2.22 uses jetty 9.4.48) from maven eclipse site and extract the contents.

Central Repository: org/eclipse/jetty/jetty-distribution/9.4.48.v20220622 (maven.org)

Unzip in powershell:

Expand-Archive -Path "C:\Users\xtao\Downloads\jetty\jetty9448.zip" -DestinationPath "C:\Users\xtao\Downloads\jetty"

**Tip: You can cross check the jetty version in %GEOSERVER_HOME%/lib

(3 files are required — ssl.mod, jetty-ssl-context.xml and jetty-util-xx.jar)

• Copy ssl.mod from /modules to %GEOSERVER_HOME%\modules
• Copy jetty-ssl-context.xml from /etc to %GEOSERVER_HOME%\etc
• Copy jetty-util-x.x.xx.jar in lib to any path on the machine and navigate to this path in cmd

Run this command:

java -cp jetty-util-<JettyVersion>.jar org.eclipse.jetty.util.security.Password password

and obtain the obfuscated password (OBF:….)

Generating obfuscated password

• Copy the OBF password and replace the existing OBF password in jetty-ssl-context.xml

<Set name="KeyStorePassword"><Property name="jetty.sslContext.keyStorePassword" deprecated="jetty.keystore.password" default="OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4"/></Set>

<Set name="KeyManagerPassword"><Property name="jetty.sslContext.keyManagerPassword" deprecated="jetty.keymanager.password" default="OBF:1u2u1wml1z7s1z7a1wnl1u2g"/></Set>

**Tip: If port needs to be changed, make changes in jetty-ssl.xml (jetty.ssl.port) in etc folder:

<Set name="port"><Property name="jetty.ssl.port" deprecated="ssl.port" default="8443" /></Set>

Change to:

<Set name="port"><Property name="jetty.ssl.port" deprecated="ssl.port" default="443" /></Set>

Also change start.ini in %GEOSERVER_HOME%

#SSL
--module=ssl
jetty.ssl.port=443
jetty.sslContext.keyStorePath=etc/keystore
jetty.sslContext.trustStorePath=etc/keystore
jetty.sslContext.keyStorePassword=password
jetty.sslContext.keyManagerPassword=password
jetty.sslContext.trustStorePassword=password
--module=https
jetty.httpConfig.securePort=443

• Restart the GeoServer service by stopping and starting GeoeServer. You can also restart in Services.msc or using start.bat in %GEOSERVER_HOME%

Now, you will be able to access secure GeoServer using https://<domain>:<port>/geoserver/web/

Cheers!

Return to Teaching