Debugging Jetty https - https

Question

I am setting up a standalone (not embedded) jetty 9.2.1 with https.
I played a bit with a self-signed certificate on my local box and all went fine.
Now I am setting up a uat server (similar to what I'll get in production), and I'm failing at getting the https running properly.
These are my steps:
1) I created a keystore, generated the cert request and submitted to my CA, got the signed certificate and imported both the new and root certificates in the keystore
2) I can verify that the keystore is looking fine and by doing:
keytool -list -keystore jetty.jks
I can see all the certificates showing with their alias
3) I placed the keystore in /etc folder and edited the jetty-ssl.xml
<Set name="KeyStorePath"><Property name="jetty.base" default="." />/<Property name="jetty.keystore" default="etc/jetty.jks"/></Set>
<Set name="KeyStorePassword"><Property name="jetty.keystore.password" default="somepassword"/></Set>
<Set name="KeyManagerPassword"><Property name="jetty.keymanager.password" default="somepassword"/></Set>
<Set name="TrustStorePath"><Property name="jetty.base" default="." />/<Property name="jetty.truststore" default="etc/jetty.jks"/></Set>
<Set name="TrustStorePassword"><Property name="jetty.truststore.password" default="somepassword"/></Set>
on startup I can see both the http and https connectors 'up'
10927 [main] INFO org.eclipse.jetty.server.ServerConnector - Started ServerConnector#231e04a9{HTTP/1.1}{0.0.0.0:8090}
11285 [main] INFO org.eclipse.jetty.server.ServerConnector - Started ServerConnector#4a1f826d{SSL-http/1.1}{0.0.0.0:8443}
11285 [main] INFO org.eclipse.jetty.server.Server - Started #12632ms
but the https does not respond, indeed I see from netstat that nothing is listening on port 8443 (while showing a healthy one for port 8090)
I tried using the 'sample' keystore shipped with jetty and got it working, which makes me think of some issue with my keystore ... but, I see no errors on the console nor in any logs (even when started with -DDEBUG=true) and I can see the keystore's certificates.
I tried also to 'force' which alias to pick with -Djetty.https-cert-alias=capi but no luck.
Any ideas on how to debug this?
Thanks!

Answer 1

I've added the following properties to enable ssl debugging:
-DDEBUG=true -Dorg.eclipse.jetty.LEVEL=DEBUG -Djavax.net.debug=ssl,handshake,data
That did the trick. ;)

Answer 2

What I did was to add the debug property to jetty startup script:
-Djavax.net.debug=all
For some reason all the debug information was available on my upstart file under /var/log/upstart/myComponent.log

Answer 3

For me this works:
-DDEBUG=true -Dorg.mortbay.jetty.LEVEL=DEBUG -Djavax.net.debug=ssl,handshake,data -classpath