A GlassFish server hosts some applications and only some of them need SSL. May be I can configure this in web.xml of the single application writing:
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
Is this the correct way ?
I thought I could achieve the same result using glassfish admin console. In the default glassfish installation there are two http listener, one with SSL on port 8181 and the other on port 8080. There is a default virtual server which has both listener. I removed listener 1 (that on port 8080) and checked that an application on a specific context path was using that virtual server. I thought it was enough to avoid http traffic to the application but it is not. I can still access it using port 8080.
What am I missing ?
In Internet I found an advice about disabling listener 1. It is not feasible to me because I would like other applications use http.
