Here is a good tutorial on Let's Encrypt, Glassfish and AWS EC2.
To highlight the keypoints(in case the link in not valid anymore):
It follows the certbot documentation described on their website upto
certbot certonly --manual -d example.com
Then comes the important part w.r.t. glassfish
Installing the certificate on Glassfish
Glassfish has a file called keystore.jks, where you need to add the certificate and key which were previously created. The file should be located at:
<AS_HOME>/domains/domain1/config/keystore.jks
and the default password for it is 'changeit'
Adding the two files to the keystore is a 2-step process:
Change directory to glassfish config directory
cd <AS_HOME>/domains/domain1/config/
Create a keystore from the 2 files
Create a .pkcs12 file containing full chain and private key
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out pkcs.p12 -name letsencryptcrt
You will set a password for this file, which you will need to specify at the next step (STORE_PASS).
Convert PKCS12 to Keystore
keytool -importkeystore -deststorepass PASSWORD_STORE -destkeypass PASSWORD_KEYPASS -destkeystore letsencrypt.jks -srckeystore pkcs.p12 -srcstoretype PKCS12 -srcstorepass STORE_PASS -alias letsencryptcrt
I would recommend setting all these passwords (PASSWORD_STORE, PASSWORD_KEYPASS and STORE_PASS) the same as the original keystore.jks’s password since, at the next point, the passwords of the source and destination keystores’ have to be the same.
Import the created keystore into Glassfish’s keystore
keytool -importkeystore -srckeystore letsencrypt.jks -destkeystore keystore.jks
Of course, make sure the paths to all the referenced files are correct, taking into account the current directory, when you are running all these commands.
Configuring the Glassfish HTTPS listener
Now that everything is setup, all you need to do is log into the Glassfish Admin Console and set the appropriate HTTP Listener.
Glassfish has 3 HTTP listeners predefined, under
Configuration > server-config > HTTP Service > HTTP Listeners.
http-listener-2 is the one for HTTPS. The following 2 settings need to be done:
Set the port to 443 (HTTPS port)
In the SSL tab, set the Certificate NickName to letsencryptcrt and the Key Store to keystore.jks
Click “Save”, restart the Glassfish instance and you’re done. You should now be able to access any deployed application via https://example.com/...