Enabling HTTPS for a Mule Application

Enabling HTTPS is a common task when developing HTTP based applications. With many platforms, such as Apache server, WebLogic, JBoss etc, it’s simply a matter of clicking a checkbox, or change one config line. For a Mule application, it takes a bit more finessing.

There are plenty of posts and online resources discussing it. Yet I still find many beginners are confused or surprised by the steps involved. Here is my end-to-end instructions I commonly share with new developers on the projects.

Assume you created your own hello-world Mule application that runs on port ${http.port}, assume that’s port 8081, sample source code like below:

<http:listener-config name=”HTTP_Listener_Configuration” host=”0.0.0.0″ port=”${http.port}” doc:name=”HTTP Listener Configuration”>
</http:listener-config>
<flow name=”https-testFlow”>
<http:listener config-ref=”HTTP_Listener_Configuration” path=”/hello” doc:name=”HTTP”/>
<set-payload value=”hello world” doc:name=”Set Payload”/>
</flow>

First of all, I strongly recommend use ${http.port} and ${https.port} properties to define the regular port and SSL port for your application. These two properties have to be spelled that way. In the future, if you run your application in Cloudhub, those two property names actually matter.

By default, http.port = 8081, https.port = 8082, Cloudhub forwards port 80 to http.port (8081), 443 to port https.port (8082) to your worker VM which runs your application.

Step 1. In order to configure HTTPS, you need to create and import your own cert first.

Choosing a Global Software Development Partner to Accelerate Your Digital Strategy

To be successful and outpace the competition, you need a software development partner that excels in exactly the type of digital projects you are now faced with accelerating, and in the most cost effective and optimized way possible.

Get the Guide

This is the part new developers find most confusing. As you will see later, if you deploy the app to Cloudhub, your cert is not even used. It’s just a place holder so your project can compile locally. Yet you have to go through the trouble creating and importing it!

Here is the keytool command to create a self-signed cert:

keytool -genkeypair -keystore keystore.jks   -dname “CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown”  -keypass password  -storepass password  -keyalg RSA  -sigalg SHA1withRSA -keysize 1024  -alias mule  -ext SAN=DNS:localhost,IP:127.0.0.1 -validity 9999

The result keystore.jks file is your certificate. Put it under src/main/resources directory

Step 2. configure your HTTPS and TLS , now your code looks like this:

<http:listener-config name=”HTTP_Listener_Configuration” host=”0.0.0.0″ port=”${http.port}” doc:name=”HTTP Listener Configuration”>
</http:listener-config>
<http:listener-config name=”HTTPs_Listener_Configuration” protocol=”HTTPS” host=”0.0.0.0″ port=”${https.port}” doc:name=”HTTP Listener Configuration”>
<tls:context>
<tls:key-store type=”jks” path=”keystore.jks” keyPassword=”password” password=”password”/>
</tls:context>
</http:listener-config>
<flow name=”https-testFlow”>
<http:listener config-ref=”HTTPs_Listener_Configuration” path=”/hello” doc:name=”HTTP”/>
<set-payload value=”hello world” doc:name=”Set Payload”/>
</flow>

Step 3. Test it

Test run locally: https://localhost:8082/hello

Please note your certificate is not trusted, your browser will complain, so click on accept/proceed or whatever to pass the warning screen.

Test it on Cloudhub – once your project is deployed to cloubhub, your certificate will be replaced by Cloudhub, your project will run on port 443, it would be something like  HTTPS://my-hello-https-test.cloudhub.io

That’s all, folks!