This topic can be a little tricky ...!

But basically there are 2 ways 1. Declarative security, in which you configure your applications web.xml and the containers' users file. Then essentially the server takes care of implementing authentication, access restriction and SSL as defined by you. This is easier but suffers from lack of portability, as the process varies for different servers.

2.Programatic security in which some or all of the security is handled by you. this is more portable but requires more work. (OR)

To enabl SSL, you need to have an SSL certificate installed on your server (web server). There are many companies who sell these certificates at nominal rates. VeriSign is one. Once you have the certificate, install this on the server and then you must be good to go.

All the best...