to confirm that the deployment descriptor file (WEB-INF/web.xml) was successfully extracted. 5. Edit the deployment descriptor to specify the key store location and password.
Edit the web.xml file to provide appropriate values for the keystoreLocation and keystorePassword elements (as well as servletPort and servletHost, if necessary): for example,

Step 3 (HTTPS Only): Validating and Installing the Server’s Self-Signed Certificate ^{^^^^^^^^^^^^^^^^^^^^^^^^^^^}^^

In order for a client application to communicate with the Web or application server, you must validate the server’s self-signed certificate and install it in the application’s trust store. The following procedure shows how:

where appServerRoot is the root directory in which the application server is installed.

where appServerRoot is, again, the root directory in which the application server is installed. 2. List the contents of the key store file.
The Key Tool utility’s -list option lists the contents of a specified key store file. For example, the following command lists the Application Server’s default key store file (keystore.jks):

The -v option tells the Key Tool utility to display certificate fingerprints in human-readable form. 3. Enter the key store password.
The Key Tool utility prompts you for the key store file’s password:

By default, the key store password is set to changeit; you can use the Key Tool utility’s -storepasswd option to change it to something more secure. After you have entered a valid password, the Key Tool utility will respond with output like the following:

The Key Tool utility responds with the output

Once again, the -v option tells the Key Tool utility to display the certificate’s fingerprints in human-readable form. The resulting output looks like the following:

where appServerInstance is the application server instance on which you are deploying the tunnel servlet. 2. Click the Deploy button. 2. Specify the .war file location: 1. Enter the location of the tunnel servlet’s Web archive file (imqhttp.war or imqhttps.war) in the File Path text field.
The file is located in the IMQ_HOME/lib directory. 2. Click the OK button. 3. Specify the context root directory: 1. Enter the `/`contextRoot portion of the tunnel servlet’s URL.
The URL has the form

or

For example, if the URL for the tunnel servlet is

the value you enter would be

or

where contextRoot is the context root directory you specified in step a above. Clients can now use this URL to connect to the message service using an HTTP or HTTPS connection. 4. Modify the server’s security policy file
Once you have deployed the HTTP or HTTPS tunnel servlet, you must grant it the appropriate permissions by modifying the Application Server’s security policy file, as described in the next procedure.

Each application server instance has a security policy file specifying its security policies or rules. Unless modified, the default security policies would prevent the HTTP or HTTPS tunnel servlet from accepting connections from the Message Queue message broker. In order for the broker to connect to the tunnel servlet, you must add an additional entry to this policy file:

where appServerRoot is the root directory in which GlassFish Server is installed. 2. Add the following entry to the file:

or

You can also improve performance by reconfiguring the connection service’s pullPeriod property. This specifies the interval, in seconds, at which each client issues HTTP/HTTPS requests to pull messages from the broker. With the default value of -1, the client will keep one such request pending at all times, ready to pull messages as fast as possible. With a large number of clients, this can cause a heavy drain on server resources, causing the server to become unresponsive. Setting the pullPeriod property to a positive value configures the client’s HTTP/HTTPS transport driver to wait that many seconds between pull requests, conserving server resources at the expense of increased response times to clients.
The connectionTimeout property specifies the interval, in seconds, that the client runtime waits for a response from the HTTP/ HTTPS tunnel servlet before throwing an exception, as well as the time the broker waits after communicating with the tunnel servlet before freeing a connection. (A timeout is necessary in this case because the broker and the tunnel servlet have no way of knowing if a client that is accessing the tunnel servlet has terminated abnormally.)

If the root certificate of the certification authority (CA) that signed your application server’s (or Web server’s) certificate is not in the trust store by default, or if you are using a proprietary application server or Web server certificate, you must install the root certificate in the trust store. (This step is not needed for ordinary, non-secure HTTP connections, or if the CA’s root certificate is already in the trust store by default.)

Installing a Root Certificate in the Trust Store

where certFile is the file containing the root certificate, certAlias is the alias representing the certificate, and trustStoreFile is the file containing your trust store. 2. Confirm that you trust the certificate.
Answer YES to the question Trust``this``certificate? 3. Identify the trust store to the client application.
In the command that launches the client application, use the -D option to specify the following properties:

To enable HTTP/HTTPS support, you need to set the connection factory’s imqAddressList attribute to the URL of the HTTP/HTTPS tunnel servlet. The URL has the form

or

where hostName`:`portNumber is the host name and port number of the application server or Web server hosting the tunnel servlet and contextRoot is the context root directory you specified when deploying the tunnel servlet on the server, as described above under Step 4 (HTTP and HTTPS): Deploying the Tunnel Servlet.

You can set the imqAddressList attribute in any of the following ways:

It is not necessary to configure multiple application or Web servers and tunnel servlets in order to access multiple brokers; you can share a single server instance and tunnel servlet among them. To do this, you must configure the imqAddressList connection factory attribute as follows:

or

where brokerHostName is the broker instance host name and instanceName is the name of the specific broker instance you want your client to access.

To check that you have entered the correct values for brokerHostName and instanceName, generate a status report for the HTTP/HTTPS tunnel servlet by accessing the servlet URL from a browser:

The report lists all brokers being accessed by the servlet, as shown in Example C-1.

Example C-1 Tunnel Servlet Status Report

To use an HTTP proxy to access the HTTPS tunnel servlet, set the system properties http.proxyHost and http.proxyPort to the proxy server’s host name and port number. You can set these properties using the -D option to the command that launches the client application.

When the service resumes, an HTTPS client should be able to connect to the broker through the tunnel servlet.