SSL can be enabled for both the API server and the UI server (default disabled).
If this is done, the corresponding ports will accept https requests only. There
is no way currently to have both http and https supported at the same time, but
this can be added, I just didn't see the need for it.
If you enable SSL, you need to set nxt.keyStorePath and nxt.keyStorePassword,
and obviously you need to have your own SSL certificate (self-signed or signed
by a CA) in a keystore file. I have only tested this with a self-signed
certificate.
keytool -keystore keystore -alias nxt -genkey -keyalg RSA
It will ask you to choose a password (that you will later need to enter in nxt.properties as nxt.keyStorePassword), and some mostly optional details for the certificate, and then generate a keystore file which you need to put in the nxt directory and point nxt.keyStorePath to it.