Enabling SSL/TLS (HTTPS)

Create a Keystore

Use a certificate from Let's Encrypt or any CA. Self-signed is fine for testing:

keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 \
  -validity 365 -storetype PKCS12 \
  -keystore keystore.p12 -storepass changeit \n  -dname "CN=example.com"

Configure the Connector

Edit conf/server.xml - uncomment and set:

<Connector port="8443" protocol="HTTP/1.1"
           maxThreads="150" SSLEnabled="true">
  <SSLHostConfig>
    <Certificate certificateKeystoreFile="conf/keystore.p12"
                 certificateKeystorePassword="changeit"
                 certificateKeystoreType="PKCS12"/>
  </SSLHostConfig>
</Connector>

Restart and test: curl -k https://localhost:8443.

Redirect HTTP to HTTPS

<Connector port="8080" protocol="HTTP/1.1">
  <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"/>
</Connector>

In web.xml, force HTTPS with a security-constraint using TRANSPORT_GUARANTEED (requires SSLEnabled + an SSL connector on 443/8443).

Modern TLS Practice

• Prefer TLS 1.2/1.3 by setting <SSLHostConfig protocols="TLSv1.2+TLSv1.3">.
• Renew letsencrypt certificates before expiry and reload Tomcat.
• In production, terminate TLS at nginx and forward to Tomcat - simpler certificates and better performance.

Key Points

• PKCS12 keystores with a strong password are the current baseline.
• Always protect the keystore file and password from other users.
• HTTPS does not hide your app behind an IP-only port - still firewall 8080.