---
title: "How to configure an SSL Certificate with Play Framework for https"
date: 2014-01-04T20:23:44+00:00
author: "poornerd"
tags: ["howto", "ssl"]
canonical: https://www.poornerd.com/2014/01/04/how-to-configure-an-ssl-certificate-with-play-framework-for-ssl/
source: Raw Markdown twin of the HTML article; content is the original source.
---
[<img src="https://www.poornerd.com/wp-content/uploads/2014/01/ssl.png" alt="ssl" width="800" height="675" class="alignleft size-full wp-image-423" srcset="https://www.poornerd.com/wp-content/uploads/2014/01/ssl.png 800w, https://www.poornerd.com/wp-content/uploads/2014/01/ssl-300x253.png 300w" sizes="(max-width: 800px) 100vw, 800px" />](https://www.poornerd.com/wp-content/uploads/2014/01/ssl.png)I spent hours trying to get this to work, and in the end, then problem was that I did not generate the CSR (Certificate Request) myself with the keytool.

I kept getting this error when I tried accessing Play with https:
  
**javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated**

The problem ended up being that the keystore I created and imported the SSL certificate into did not have the public key that was used for the CSR (certificate request).

So here it the quick version of generating an SSL Certificate with godaddy.com and installing it with Play Framework 2.1+.

1. Follow these instructions from <a href="http://support.godaddy.com/help/article/5276/generating-a-certificate-signing-request-csr-tomcat-4x5x6x" onclick="javascript:pageTracker._trackPageview('/outbound/article/support.godaddy.com');" target="_blank">godaddy.com</a> to generate the CSR like this:
  
First generate the key pair like this:

<pre>keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore</pre>

Then generate the CSR:

<pre>keytool -certreq -alias tomcat -file csr.txt -keystore tomcat.keystore</pre>

2. Use the CSR to apply for certificate

3. Add the Intermediate Certificate Bundle and the Certificate that were generated to your keystore.
  
**NOTE: make sure this is the same keystore that you generated the private key in, in step 1!**

<pre>keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_bundle.crt
keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file mycert.crt</pre>

(Replace mycert.crt with the file name and location of the new GoDaddy certificate)

4. Finally, following the instructions for configuring https with Play 2.1+ ( <a href="http://www.playframework.com/documentation/2.2.1/ConfiguringHttps" onclick="javascript:pageTracker._trackPageview('/outbound/article/www.playframework.com');" target="_blank">http://www.playframework.com/documentation/2.2.1/ConfiguringHttps </a>) which had already worked great with the self generated key, I created a shell script for starting Play with the correct parameters:

<pre class="brush: plain; title: ; notranslate" title=""># script for starting play in production with SSL and the keystore
target/start -Dhttps.port=443 -Dhttps.keyStore=/Users/bp/mypath/tomcat.keystore -Dhttps.keyStorePassword=itl80809
</pre>

Note: you need to do a &#8220;play dist&#8221; beforehand, so that the current Software is compiled into a distribution in the target subdirectory.