Which profile should I use in production?

You can use any profile you want. All profiles should be capable of serving production requirements.

A profile is a short-cut to configure the domains for specific needs. Domain with any profile will need
to be tuned for specific loads of production usage.

The only subtle difference between developer and cluster/enterprise is the former does not support
the notion of app server clusters, latter two do.

Cluster profile is almost certainly what you should choose. This gives you the JKS keystore to manage your certificates and keys and in-memory replication for application availability.

See: http://wiki.glassfish.java.net/attach/GlassFishV2AdminRelatedOnePagers/admin-fs.html
and
http://wiki.glassfish.java.net/attach/GlassFishV2AdminRelatedOnePagers/gfv2-profiles-arc.html

(initial answer posted here)