Skip to main content

Install an SSL Certificate (JKS Format) on a Tomcat Server

By installing an SSL certificate on a Tomcat server, you can enable HTTPS secure access to the Tomcat server. This article describes how to install an SSL certificate on a Tomcat server.

Note

This document uses Tomcat version 9.0.13 as an example. Before installation, confirm that port 443 is not occupied. If port 443 is already in use, bind another port when installing the certificate.

Obtain the Certificate​

  1. After we issue the certificate for you, you will receive the certificate file in .zip compressed format. The compressed package contains four folders corresponding to four certificate formats: Tomcat, Nginx, IIS, and Apache. This document uses the JKS format for installation and uses the certificate in the Tomcat folder.

  2. The Tomcat folder will contain three files:

  • domain_com.jks certificate file
  • domain_com.key private key file
  • password.txt certificate password file

Install the SSL Certificate​

  1. Copy the obtained domain_com.jks certificate file from your local directory to the /usr/tomcat9.0.13/conf directory on the Tomcat server.
  • The path names may vary slightly between different Tomcat versions. Please operate in the path corresponding to your service.
  • For some users, if your JDK version is different from the JDK version in the environment where we converted the JKS file, you may need to manually convert the JKS file in your current usage environment.

Please refer to the command below to convert the JKS file, and note to replace the corresponding parameters:

keytool -importkeystore -srckeystore domain.pfx -srcstoretype pkcs12 -srcstorepass pfxpassword -destkeystore domain.jks -deststoretype jks -deststorepass pfxpassword

Replace domain.pfx (the pfx file in the IIS folder), pfxpassword (the password of the pfx file), domain.jks (the name of the converted jks file), and pfxpassword (the password of the PFX file).

  1. Edit the server.xml file in the /usr/tomcat9.0.13/conf directory. Add the Connector attribute to the server.xml file with the following content:
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
  maxThreads="150" scheme="https" secure="true"
  keystoreFile="/usr/tomcat9.0.13/conf/domain_com.pfx" <! -- Path to the certificate -->
  keystorePass="Certificate password"  <! -- Replace with the content in the password.txt file -->
  clientAuth="false"/>
  1. Save the configuration file, then run the following command in the bin directory to confirm whether the configuration is correct.
./configtest.sh
  1. Restart Tomcat. Run the following command in the bin directory:
./shutdown.sh  #关闭 Tomcat 服务器
./startup.sh   #启动 Tomcat 服务器

Testing the SSL Certificate​

Enter the domain name bound to the SSL certificate in your browser's address bar to test whether your SSL certificate has been installed successfully. If the installation is successful, a security padlock icon will appear in the browser's address bar, and you can click it to view the certificate information.

SSL Certificate Effect

Security Configuration for Automatic HTTP to HTTPS Redirection (Optional)​

If you need to automatically redirect HTTP requests to HTTPS, you can configure it by following these steps:

  1. Edit the web.xml file under the /usr/tomcat9.0.13/conf directory, and locate the </welcome-file-list> tag.
  2. Start a new line after the closing tag </welcome-file-list> and add the following content.
<login-config>  
 <!-- Authorization setting for SSL -->  
 <auth-method>CLIENT-CERT</auth-method>  
 <realm-name>Client Cert Users-only Area</realm-name>  
</login-config>  
<security-constraint>  
 <!-- Authorization setting for SSL -->  
 <web-resource-collection >  
     <web-resource-name >SSL</web-resource-name>  
     <url-pattern>/*</url-pattern>  
 </web-resource-collection>  
 <user-data-constraint>  
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>  
 </user-data-constraint>  
</security-constraint>
  1. Edit the server.xml file in the /usr/tomcat9.0.13/conf directory, and change the redirectPort parameter to the connector port used for SSL, which is port 443, as shown below:
<Connector port="80" protocol="HTTP/1.1"
  connectionTimeout="20000"
  redirectPort="443" />
  1. Save the configuration file, and run the following command in the bin directory to verify that the configuration is correct.
./configtest.sh
  1. If the configuration is correct, restart the Tomcat server to access the site using the domain name and enable automatic redirection from HTTP to HTTPS.
./shutdown.sh  #关闭 Tomcat 服务器
./startup.sh   #启动 Tomcat 服务器
Last updated on