Skip to main content

Installing an SSL Certificate (PFX Format) on a Tomcat Server

By installing an SSL certificate on your Tomcat server, you can enable HTTPS secure access for it. This document describes how to install an SSL certificate on a Tomcat server.

Note

This document uses Tomcat version tomcat9.0.13 as an example. Before installation, confirm that port 443 is not occupied. If port 443 is already in use, bind another port when installing the certificate.

Obtain the Certificate​

  1. After we issue the certificate for you, we will provide the certificate file in .zip compressed format. The archive contains four folders corresponding to four certificate formats: Tomcat, Nginx, IIS, and Apache. Since this document uses the PFX format for installation, you need to use the certificate in the IIS folder. (The files in different folders only differ in format; using files from other folders does not cause conflicts.)
  2. The IIS folder contains three files:
  • domain_com.pfx certificate file
  • domain_com.key private key file
  • password.txt certificate password file

Install the SSL Certificate​

  1. Copy the obtained domain_com.pfx certificate file from your local directory to the /usr/tomcat9.0.13/conf directory on the Tomcat server. The path name may vary slightly between different Tomcat versions; please navigate to the corresponding path for your service to perform the operation.
  2. Edit the server.xml file located in the /usr/tomcat9.0.13/conf directory. Add the Connector attribute to the server.xml file with the following content:
<Connector port="443"  
protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="/usr/tomcat9.0.13/conf/domain_com.pfx" <! -- Path to the certificate -->
    keystoreType="PKCS12"
    keystorePass="Certificate password"  <! -- Replace with the content from the password.txt file -->
    clientAuth="false"
    SSLProtocol="TLSv1.1+TLSv1.2+TLSv1.3"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>
  1. Save the configuration file and run the following command in the bin directory to verify if the configuration is correct.
./configtest.sh
  1. Restart Tomcat, and execute the following command in the bin directory:
./shutdown.sh  #关闭 Tomcat 服务器
./startup.sh   #启动 Tomcat 服务器

Test the SSL Certificate​

Enter the domain name bound to the SSL certificate in the browser address bar to test whether your SSL certificate is installed successfully. If successful, a security padlock icon will appear in the browser address bar, and you can click it to view certificate information.

SSL certificate effect

Security Configuration for Automatic HTTP to HTTPS Redirection (Optional)​

If you need to automatically redirect HTTP requests to HTTPS, you can configure it by following the steps below:

  1. Edit the web.xml file in the /usr/tomcat9.0.13/conf directory and locate the </welcome-file-list> tag.
  2. Add a new line after the closing tag </welcome-file-list> and insert the following content.
<login-config>  
 <!-- Authorization setting for SSL -->  
 <auth-method>CLIENT-CERT</auth-method>  
 <realm-name>Client Cert Users-only Area</realm-name>  
</login-config>  
<security-constraint>  
 <!-- Authorization setting for SSL -->  
 <web-resource-collection >  
     <web-resource-name >SSL</web-resource-name>  
     <url-pattern>/*</url-pattern>  
 </web-resource-collection>  
 <user-data-constraint>  
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>  
 </user-data-constraint>  
</security-constraint>
  1. Edit the server.xml file under the /usr/tomcat9.0.13/conf directory, and change the redirectPort parameter to the SSL port for connector, which is port 443, as shown below:
<Connector port="80" protocol="HTTP/1.1"
  connectionTimeout="20000"
  redirectPort="443" />
  1. Save the configuration file, and run the following command in the bin directory to verify that the configuration is correct.
./configtest.sh
  1. If the configuration is correct, restart the Tomcat server to access your website via the domain name, and enable automatic redirection from HTTP to HTTPS.
./shutdown.sh  #关闭 Tomcat 服务器
./startup.sh   #启动 Tomcat 服务器
Last updated on