How to add a SSL connector for apache karaf?

Question

While searching for an answer to this question I stumbled upon http://blog.nanthrax.net/2013/02/multiple-http-connectors-in-apache-karaf/ and Jetty SSL configuration Apache karaf but this information is outdated. I found the new documentation at https://www.eclipse.org/jetty/documentation/current/configuring-connectors.html and the examples differ from proposed configurations. Apache Karaf 4.0.2 seems to use Jetty 9.

I already have a keystore at ${karaf.home}/etc/keystores/keystore.jks and would like just to add a second ssl connector at port 14000. How to do that?

Here's my org.ops4j.pax.web.cfg:

org.osgi.service.http.port=8181

org.osgi.service.http.port.secure=8443
org.osgi.service.http.secure.enabled=true
org.ops4j.pax.web.ssl.keystore=./etc/keystores/keystore.jks
org.ops4j.pax.web.ssl.password=password
org.ops4j.pax.web.ssl.keypassword=password

org.ops4j.pax.web.config.file=${karaf.home}/etc/jetty.xml

Here's my jetty.xml:

<Configure id="Server" class="org.eclipse.jetty.server.Server">
    <Call name="addConnector">
        <Arg>
            <New class="org.eclipse.jetty.server.ServerConnector">
                <Arg name="server">
                    <Ref refid="Server" />
                </Arg>
                <Arg name="factories">
                    <Array type="org.eclipse.jetty.server.ConnectionFactory">
                        <Item>
                            <New class="org.eclipse.jetty.server.SslConnectionFactory"></New>
                        </Item>
                        <Item>
                            <New class="org.eclipse.jetty.server.HttpConnectionFactory"></New>
                        </Item>
                    </Array>
                </Arg>
                <Set name="host">
                    <Property name="jetty.host" default="0.0.0.0" />
                </Set>
                <Set name="port">
                    <Property name="jetty.port" default="14000" />
                </Set>
                <Set name="idleTimeout">
                    <Property name="http.timeout" default="30000" />
                </Set>
                <Set name="name">restConnector:14000</Set>
            </New>
        </Arg>
    </Call>
</Configure>

I had to set name like this to workaround an ArrayIndexOutOfBoundsException 1 in pax-web-jetty-4.2.2.jar at org.ops4j.pax.web.service.jetty.internal.ServerControllerImpl$Stopped.start(ServerControllerImpl.java:503):

String[] split = connector.getName().split(":");
if (httpSecurePort == Integer.valueOf(split[1])
        .intValue()
        && address.equalsIgnoreCase(split[0])) { ... }

Now the connector seems to start from what I see in the log:

2016-02-03 13:39:19,821 | INFO  | pool-60-thread-1 | JettyServerImpl                  | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | Pax Web available at [localhost]:[14000]
2016-02-03 13:39:19,821 | INFO  | pool-60-thread-1 | JettyFactoryImpl                 | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | SPDY not available, creating standard ServerConnector for Http
2016-02-03 13:39:19,822 | INFO  | pool-60-thread-1 | JettyServerImpl                  | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | Pax Web available at [0.0.0.0]:[8181]
2016-02-03 13:39:19,825 | INFO  | pool-60-thread-1 | JettyFactoryImpl                 | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | No ALPN class available
2016-02-03 13:39:19,825 | INFO  | pool-60-thread-1 | JettyFactoryImpl                 | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | SPDY not available, creating standard ServerConnector for Https
2016-02-03 13:39:19,825 | INFO  | pool-60-thread-1 | JettyServerImpl                  | 128 - org.ops4j.pax.web.pax-web-jetty - 4.2.2 | Pax Web available at [0.0.0.0]:[8443]
...
2016-02-03 14:02:03,493 | INFO  | pool-54-thread-1 | ContextHandler                   | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | Started HttpServiceContext{httpContext=org.apache.felix.webconsole.internal.servlet.OsgiManagerHttpContext@33dd06a6}
2016-02-03 14:02:03,493 | INFO  | pool-54-thread-1 | Server                           | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | jetty-9.2.10.v20150310
2016-02-03 14:02:03,571 | INFO  | pool-54-thread-1 | ServerConnector                  | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | Started restConnector:14000@1ed3b7fb{SSL-HTTP/1.1}{0.0.0.0:14000}
2016-02-03 14:02:03,571 | INFO  | pool-54-thread-1 | ServerConnector                  | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | Started default@723f99b6{HTTP/1.1}{0.0.0.0:8181}
2016-02-03 14:02:03,602 | INFO  | pool-54-thread-1 | ServerConnector                  | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | Started secureDefault@15203cf8{SSL-http/1.1}{0.0.0.0:8443}
2016-02-03 14:02:03,602 | INFO  | pool-54-thread-1 | Server                           | 115 - org.eclipse.jetty.util - 9.2.10.v20150310 | Started @14307ms

But if I try to open https://localhost:14000/ in my browser I get ERR_CONNECTION_CLOSED and the following exception is thrown:

2016-02-03 15:46:00,509 | DEBUG | qtp427346077-223 | HttpConnection                   | 79 - org.eclipse.jetty.util - 9.2.10.v20150310 |
javax.net.ssl.SSLHandshakeException: no cipher suites in common
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)[:1.8.0_60]
...
Caused by: javax.net.ssl.SSLHandshakeException: no cipher suites in common
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)[:1.8.0_60]

Do I miss something in the jetty configuration?

Danny Lo · Answer 1 · 2016-02-04T02:10:35.573

After hours of trying out different configurations and debugging with eclipse debugger plus log:set DEBUG in karaf I finally came to the right configuration. Here it is:

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory">
    <Set name="KeyStorePath"><Property name="jetty.home" default="." />/etc/keystores/keystore.jks</Set>
    <Set name="KeyStorePassword">OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4</Set>
    <Set name="KeyManagerPassword">OBF:1u2u1wml1z7s1z7a1wnl1u2g</Set>
    <Set name="TrustStorePath"><Property name="jetty.home" default="." />/etc/keystores/keystore.jks</Set>
    <Set name="TrustStorePassword">OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4</Set>
  </New>
  <Call name="addConnector">
    <Arg>
      <New class="org.eclipse.jetty.server.ServerConnector">
        <Arg name="server">
          <Ref refid="Server" />
        </Arg>
        <Arg name="factories">
          <Array type="org.eclipse.jetty.server.ConnectionFactory">
            <Item>
              <New class="org.eclipse.jetty.server.SslConnectionFactory">
                <Arg name="next">http/1.1</Arg>
                <Arg name="sslContextFactory"><Ref refid="sslContextFactory"/></Arg>
              </New>
            </Item>
            <Item>
              <New class="org.eclipse.jetty.server.HttpConnectionFactory"></New>
            </Item>
          </Array>
        </Arg>
        <Set name="host">
          <Property name="jetty.host" default="0.0.0.0" />
        </Set>
        <Set name="port">
          <Property name="jetty.port" default="14000" />
        </Set>
        <Set name="idleTimeout">
          <Property name="http.timeout" default="30000" />
        </Set>
        <Set name="name">restConnector:14000</Set>
      </New>
    </Arg>
  </Call>
</Configure>

The crucial points are:

Pick a connector name with a colon to workaround PAXWEB-907
An instance of SslContextFactory should be created with keystore properties and referenced in SslConnectionFactory
It is needed to declare both SslConnectionFactory and HttpConnectionFactory whereby it is important to declare them right in this order.

as alternative to the PAXWEB-907 issue do an upgrade to Karaf 4.0.4 which includes a fix for this. — Achim Nierbeck, Feb 05 '16 at 08:18
How do you make Apache Karaf read jetty.xml ? org.ops4j.pax.web.config.file=${karaf.home}/etc/jetty.xml does not work for me — Diego Ramos, Mar 01 '21 at 22:29

score 0 · Answer 2 · answered Mar 02 '17 at 23:18

I recently had to face the same situation that I passed pretty easily. I created my own jks self-signed and then configured only Pax Web via cfg files.

Create JKS

keytool -genkeypair -keyalg RSA -validity 2048 \ -alias dontesta-karaf \ -dname "cn=karaf.dontesta.it, ou=R&D Labs, o=Antonio Musarra's Blog, C=IT, L=Rome, S=Italy" \ -keypass changeit -storepass changeit \ -keystore dontesta-karaf-server.jks \ -ext SAN=DNS:www.dontesta.it,DNS:services.dontesta.it
Configure CFG Pax Web

javax.servlet.context.tempdir = /Users/amusarra/Progetti/Karaf/runtime/apache-karaf-4.0.8/data/pax-web-jsp org.ops4j.pax.web.config.file = /Users/amusarra/Progetti/Karaf/runtime/apache-karaf-4.0.8/etc/jetty.xml org.osgi.service.http.port = 8181

org.osgi.service.http.secure.enabled=true org.ops4j.pax.web.ssl.keystore=${karaf.etc}/keystore/dontesta-karaf-server.jks org.ops4j.pax.web.ssl.password=changeit org.ops4j.pax.web.ssl.keypassword=changeit

For more info can you see at https://www.dontesta.it/blog/2017/03/02/come-abilitare-https-apache-karaf-pax-web/

How to add a SSL connector for apache karaf?

2 Answers2

Linked