So I am trying to build an HTTPS server in java without using SocketChannels and the SSLEngine. My main reason is when I built using the com.sun packaging and tested it a lot of request timed out and if they did respond they took around 2 minutes (In debugger handlers would take 2 minutes to even be called) I built an HTTP server and got request to go down to 200ms but I need HTTPS and when I added the SSLEngine and unwrapped the request it looked like a normal header for HTTP, the request looked like so:
GET / HTTP/1.1
Host: localhost
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
DNT: 1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Based on that it seems the request is not using HTTPS (Also chrome says website is not secure) and is not requesting an upgrade. How do I tell the client to upgrade? All pages I have read said client should request the upgrade, and if I tried to send a 426 code header (Upgrade required) the server simply closes the connection and shows the message I sent along with it.
Answer is simple, localhost certificates are not valid in any way, I made a certificate for my website and tested externally and was able to get a proper response. As far as I know, server cannot request the client to change protocols 100% of the time.