Guidelines for Setting up SSL on Tomcat

2 years ago

3 minutes

SSL is a cryptographic protocol that ensures the security of messages transmitted over the internet. It utilizes private and public keys to encrypt messages before transmitting them over the network. To set up SSL on Tomcat, a digital certificate is required. In the development environment, this certificate can be generated using Java keytool. However, in a production environment, it is recommended to obtain the digital certificate from recognized SSL certificate providers such as Verisign, Entrust, or Lets’ Encrypt.

Generating an SSL certificate.

To make your own digital certificate, simply follow the steps provided below.

$ keytool -genkey -alias tomcat -keyalg RSA -keystore mycertificate.cert
Enter keystore password:
Re-enter new password:
What is your first and last name?
  [Unknown]:  Pankaj Kumar
What is the name of your organizational unit?
  [Unknown]:  Dev
What is the name of your organization?
  [Unknown]:  Silicon Cloud
What is the name of your City or Locality?
  [Unknown]:  Bangalore
What is the name of your State or Province?
  [Unknown]:  Karnataka
What is the two-letter country code for this unit?
  [Unknown]:  IN
Is CN=Pankaj Kumar, OU=Dev, O=Silicon Cloud, L=Bangalore, ST=Karnataka, C=IN correct?
  [no]:  Yes

Enter key password for <tomcat>
	(RETURN if same as keystore password):
Re-enter new password:
$ ls
mycertificate.cert

I have utilized the password “changeit” for Keystore and key, however, you are free to choose any password you desire. Now that our digital certificate is prepared, the subsequent phase involves activating the HTTPS communication port in Tomcat and configuring it to utilize our digital certificate for SSL support.

Secure communication for Tomcat using the HTTPS protocol.

To activate SSL, please access the ~Tomcat_Installation/conf/server.xml file and remove the comment character from the following line.

<Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               keystoreFile="/Users/Pankaj/tomcat/conf/mycertificate.cert"
	       clientAuth="false" sslProtocol="TLS" />

Redirect HTTP to HTTPS in Tomcat.

We have the capability to access any web application using both HTTP and HTTPS ports. By configuring Tomcat, we can ensure that all HTTP requests are automatically redirected to the HTTPS port.

In the ~TomcatInstallation/conf/web.xml file, add the following configuration, ensuring that it is placed after all the servlet-mapping tags:

Entire Application
/*

CONFIDENTIAL

To initiate the tomcat restart, all HTTP requests will be automatically redirected to HTTPS. For example, https://localhost:8080/axis2 will be redirected to https://localhost:8443/axis2. Please note that if you prefer not to include ports in the URLs, you can use 80 for HTTP and 443 for HTTPS. In this scenario, the initial step of redirecting HTTP requests to HTTPS can be skipped as it will automatically select the default port 443. Additionally, if you are currently working with Tomcat, you may find the following posts relevant and useful.

Java Web Application Tutorial
Java Servlet Tutorial