Configure SSL in blueprint for CXF - https

Question

I have an existing application deployed to Apache Karaf OSGi container.
The application bundles implement SOAP and REST web services using Apache CXF, configured by blueprint.xml files that look like this:
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"
xmlns:jaxws="http://cxf.apache.org/blueprint/jaxws"
xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.2.0"
xsi:schemaLocation="
http://www.osgi.org/xmlns/blueprint/v1.0.0 http://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd
http://cxf.apache.org/blueprint/jaxws http://cxf.apache.org/schemas/blueprint/jaxws.xsd
http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0 http://aries.apache.org/schemas/blueprint-cm/blueprint-cm-1.1.0.xsd
http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.2.0 http://aries.apache.org/schemas/blueprint-ext/blueprint-ext.xsd">
<jaxws:endpoint id="bundle1-server" implementor="com.myapp.Bundle1ServiceImpl" endpointName="s:Bundle1Port"
serviceName="s:Bundle1Service" address="http://0.0.0.0:9080/SoapContext/Bundle1Port" wsdlLocation="wsdl/Bundle1Service.wsdl" xmlns:s="http://com.myapp/services/bundle1service">
</jaxws:endpoint>
</blueprint>
When the endpoint starts, I can see this in the log:
INFO | org.apache.cxf.endpoint.ServerImpl | | org.apache.cxf.endpoint.ServerImpl - initDestination - 85 | 109 - org.apache.cxf.cxf-core - 3.1.9 | Setting the server's publish address to be http://0.0.0.0:9080/SoapContext/Bundle1Port
INFO  | org.eclipse.jetty.server.ServerConnector |  | org.eclipse.jetty.server.AbstractConnector - doStart -  266 | 204 - org.eclipse.jetty.util - 9.2.15.v20160210 | Started ServerConnector#30394ac6{HTTP/1.1}{0.0.0.0:9080}
The CXF uses Jetty to receive the incoming HTTP requests (there is a cxf-rt-transports-http-jetty dependency in the pom.xml).
I want to switch the web services from http to https.
When I change the port number in the blueprint.xml, the web service is indeed reachable at the new port.
However, changing the URL scheme from http to https (http://:9080 to https://:9443) results in an error:
org.osgi.service.blueprint.container.ComponentDefinitionException: Unable to initialize bean bundle1-server
...
Caused by: java.io.IOException: Protocol mismatch for port 9443: engine's protocol is http, the url protocol is https
at org.apache.cxf.transport.http_jetty.JettyHTTPServerEngineFactory.createJettyHTTPServerEngine(JettyHTTPServerEngineFactory.java:277)
Obviously, I also need to specify the server certificate and the CA certificate. I have tried to add the following:
<httpj:engine-factory bus="cxf">
<httpj:engine port="9443">
<httpj:tlsServerParameters>
<sec:keyManagers keyPassword="changeit">
<sec:keyStore type="JKS" password="changeit"
file="/path-to-certificates/keystore.ks"/>
</sec:keyManagers>
<sec:trustManagers>
<sec:keyStore type="JKS" password="password"
file="/path-to-certificates/truststore.ks"/>
</sec:trustManagers>
<sec:clientAuthentication want="false" required="false"/>
</httpj:tlsServerParameters>
</httpj:engine>
</httpj:engine-factory>
But now I get:
org.osgi.service.blueprint.container.ComponentDefinitionException: Unable to load class org.eclipse.jetty.server.Connector from recipe MapRecipe[name='#recipe-85']
...
Caused by: java.lang.ClassNotFoundException: org.eclipse.jetty.server.Connector not found by Bundle1 [255]
at org.apache.felix.framework.BundleWiringImpl.findClassOrResourceByDelegation(BundleWiringImpl.java:1574)[org.apache.felix.framework-5.4.0.jar:]
at org.apache.felix.framework.BundleWiringImpl.access$400(BundleWiringImpl.java:79)[org.apache.felix.framework-5.4.0.jar:]
at org.apache.felix.framework.BundleWiringImpl$BundleClassLoader.loadClass(BundleWiringImpl.java:2018)[org.apache.felix.framework-5.4.0.jar:]
at java.lang.ClassLoader.loadClass(ClassLoader.java:351)[:1.8.0_262]
at org.apache.felix.framework.Felix.loadBundleClass(Felix.java:1925)[org.apache.felix.framework-5.4.0.jar:]
at org.apache.felix.framework.BundleImpl.loadClass(BundleImpl.java:978)[org.apache.felix.framework-5.4.0.jar:]
at org.apache.aries.blueprint.container.BlueprintContainerImpl.loadClass(BlueprintContainerImpl.java:467)[13:org.apache.aries.blueprint.core:1.6.1]
at org.apache.aries.blueprint.container.BlueprintRepository.loadClass(BlueprintRepository.java:419)[13:org.apache.aries.blueprint.core:1.6.1]
at org.apache.aries.blueprint.container.GenericType.parse(GenericType.java:135)[13:org.apache.aries.blueprint.core:1.6.1]
at org.apache.aries.blueprint.di.AbstractRecipe.doLoadType(AbstractRecipe.java:168)[13:org.apache.aries.blueprint.core:1.6.1]
What am I missing here?
Update: I also tried to configure SSL globally for the whole Karaf server by editing etc/org.ops4j.pax.web.cfg to include
org.osgi.service.http.secure.enabled=true
org.ops4j.pax.web.ssl.keystore=/path-to-keystore.ks
org.ops4j.pax.web.ssl.password=changeit
org.ops4j.pax.web.ssl.keypassword=changeit
org.osgi.service.http.port.secure=8443
Then I can see in the logs
INFO | org.ops4j.pax.web.service.jetty.internal.JettyServerImpl | | org.ops4j.pax.web.service.jetty.internal.JettyServerImpl - addConnector - 226 | 222 - org.ops4j.pax.web.pax-web-jetty - 4.2.6 | Pax Web available at [0.0.0.0]:[8443]
INFO | org.eclipse.jetty.server.ServerConnector | | org.eclipse.jetty.server.AbstractConnector - doStart - 266 | 204 - org.eclipse.jetty.util - 9.2.15.v20160210 | Started secureDefault#3bae4ef2{SSL-http/1.1}{0.0.0.0:8443}
..
Caused by: java.io.IOException: Protocol mismatch for port 8443: engine's protocol is http, the url protocol is https
Which is really confusing...

Answer 1

I have fixed the ClassNotFoundException by adding org.eclipse.jetty.server to Import-Package in META-INF/MANIFEST.MF
However, I have read this: "I strongly discourage people from configuring the jetty servers in their blueprint files" http://servicemix.396122.n5.nabble.com/servicemix-5-4-0-cxf-jetty-blueprint-issue-td5722268.html
So maybe I should still try to fix the latter (global) config if possible.