Configure HTTPS in Tomcat by obtaining a certificate, storing its private key and certificate chain in a Java keystore or PEM files, and enabling an SSL connector in $CATALINA_BASE/conf/server.xml. Keep the HTTP connector if you need redirects, but understand that its redirectPort is conditional: Tomcat uses it when a matching Servlet security-constraint requires confidential transport. If every HTTP URL must move to HTTPS, perform a permanent redirect at your reverse proxy or load balancer and configure Tomcat to understand the public host, port and scheme.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Tomcat SSL configuration actually does
Tomcat can terminate TLS itself or receive already-encrypted traffic that was terminated by a reverse proxy or load balancer. Those are different deployment designs:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Design | Where the certificate and private key live | How HTTP is redirected | When it fits |
|---|---|---|---|
| Tomcat terminates TLS | Tomcat’s Java keystore or certificate/key files | Servlet security constraints can invoke redirectPort; a separate edge redirect may still be used |
A direct installation, a lab, or a small deployment without a TLS-capable edge |
| Reverse proxy terminates TLS | The proxy or load balancer | The edge listener returns a permanent redirect for HTTP; Tomcat receives HTTPS-originated requests over the internal connection | Multiple applications, centralized certificates, or public traffic already managed by an edge |
| Hybrid | Both layers have certificates | Redirect and encryption policy must be coordinated at both layers | Only when an internal security boundary specifically requires encryption between proxy and Tomcat |
The secure connector needs SSLEnabled="true", an SSLHostConfig, and a Certificate. Tomcat supports the JSSE and OpenSSL TLS implementations. NIO and NIO2 connectors can use either implementation; APR/native uses OpenSSL. The exact certificate attributes depend on whether you use a keystore or PEM files and on the Tomcat version installed, so treat the connector reference for that version as authoritative.
Decide the certificate, port and TLS implementation first
Use a publicly trusted certificate in production
Obtain a certificate from a trusted certificate authority for every public hostname users will enter. The certificate must cover the hostname through its Subject Alternative Name entries, and the server must present the issuing chain that clients need. A self-signed certificate is useful for proving that the connector works in a laboratory, but normal browsers will display a trust warning until the issuing certificate is explicitly trusted.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Choose a keystore or PEM files
A Java keystore, commonly a PKCS12 file, keeps the private key, certificate and chain together. PEM configuration keeps the certificate, private key and chain as separate files. Both are supported; choose the format that matches your certificate-management process. Protect the private key and the keystore password, and give the Tomcat service account only the read access it needs.
Choose the listener port
Tomcat examples commonly use HTTPS on port 8443. Port 443 is also valid, but ports below 1024 can require operating-system privileges or a fronting service that owns the privileged port. Whichever port you select, use the same value in the public URL, the HTTP connector’s redirectPort, proxy metadata and any firewall or load-balancer rule.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose JSSE or OpenSSL deliberately
JSSE is the Java TLS implementation and is available with standard Tomcat Java connectors. OpenSSL can be used through the supported connector configurations; APR/native uses OpenSSL. This choice affects the connector and certificate attributes, not the redirect logic. Do not copy a PEM-oriented example into a keystore configuration, or vice versa.
Prepare certificate material
Lab-only self-signed keystore
For a disposable test instance, a self-signed PKCS12 keystore can verify that Tomcat is reading a key and serving TLS. For example:
keytool -genkeypair -alias tomcat -keyalg RSA -storetype PKCS12 -keystore conf/localhost.p12 -validity 365Answer the prompts with the hostname you will actually test, and record the keystore password. This creates a certificate that clients do not inherently trust; it is not a substitute for a certificate issued for a production hostname.
Import a CA-issued certificate into a keystore
If your certificate authority supplied a certificate and one or more intermediate certificates, import the chain in the correct order and associate the leaf certificate with the private-key alias. Verify the keystore type, alias, chain and expiry before editing Tomcat. A useful inspection command is:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
keytool -list -v -keystore conf/tomcat.p12 -storetype PKCS12Run file and certificate inspection as the same operating-system account, or with equivalent permissions, that will run Tomcat. A file that is readable by an administrator but not by the service account will produce a startup failure that looks like a bad path or password.
Prepare PEM files
For a PEM setup, keep the server certificate, private key and issuing chain as separate files in a directory readable only by the Tomcat service. The private key should not be world-readable, and backups must receive the same protection. Confirm that the certificate’s SAN contains the public hostname and that the chain file contains intermediate certificates in the order expected by the clients.
Configure the connectors in server.xml
Keep the clear-text connector when redirects are required
Open $CATALINA_BASE/conf/server.xml, not a copy in an unrelated installation directory. Retain the HTTP connector that accepts clear-text requests and set its redirectPort to the secure listener’s port:
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" />The value does not itself redirect all traffic. It tells Catalina which port to use when a request matches a Servlet security constraint that requires SSL.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Add a keystore-backed HTTPS connector
This is the modern shape for a JSSE NIO connector using a PKCS12 keystore:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="conf/localhost.p12"
certificateKeystorePassword="changeit"
type="RSA" />
</SSLHostConfig>
</Connector>The relative path conf/localhost.p12 is resolved from $CATALINA_BASE. Use an absolute path if your deployment requires one, and do not leave a real production password in a world-readable configuration file. The example’s password and filename are illustrative; replace them with your protected values.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Use PEM certificate attributes when that is your chosen format
A PEM-based connector uses certificate-file attributes instead of a keystore-file attribute. The exact names and accepted combinations vary by Tomcat release and TLS implementation; a typical modern structure is:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateFile="conf/server.crt"
certificateKeyFile="conf/server.key"
certificateChainFile="conf/chain.crt"
type="RSA" />
</SSLHostConfig>
</Connector>Check the connector reference shipped for your installed Tomcat before using this form, especially if you are using APR/native, an elliptic-curve key, multiple hostnames or more than one certificate.
Account for multiple hostnames
An SSLHostConfig can represent a TLS virtual host. If several public hostnames share the listener, configure the default host and additional certificate entries according to the Tomcat version’s documented SNI syntax. Every hostname still needs certificate coverage; adding a second DNS name to Tomcat does not make it valid on a certificate that omits that name.
Restart and read the startup log
Restart Tomcat after changing server.xml. A successful startup should bind the intended HTTPS port. Read the startup log rather than assuming that a running process means TLS is active. Look specifically for keystore path, password, certificate-chain, private-key, protocol and port-binding errors. If Tomcat cannot load the secure connector, the clear-text connector may continue to answer while HTTPS remains unavailable.
Verify the HTTPS endpoint before adding redirects
- From a client that resolves the public hostname, request
https://host:8443/, orhttps://host/when the listener is on port 443. - For a CA-issued certificate, inspect the certificate subject, SAN, expiry and issuer in the browser or with a TLS inspection tool. For a self-signed lab certificate, expect a trust warning and inspect the certificate details rather than treating the warning as a connector failure.
- Confirm that the complete chain is presented. A server certificate that works for one client may fail for another when an intermediate certificate is missing.
- Check that the application responds over HTTPS before testing an HTTP-to-HTTPS redirect. This separates certificate and connector problems from redirect-policy problems.
Understand redirectPort and Servlet security constraints
Tomcat’s redirectPort is conditional. When a clear-text request matches a Servlet security-constraint whose transport guarantee is CONFIDENTIAL, Catalina redirects the request to the configured secure port. A request that does not match such a constraint is not automatically redirected merely because redirectPort is present.
Add a constraint to an application
In the application’s WEB-INF/web.xml, protect the URL patterns that must use TLS:
Recommended Free Tools
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
<security-constraint>
<web-resource-collection>
<web-resource-name>Secure application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>Deploy or reload the application, then request a URL covered by /* over HTTP. Tomcat should send a redirect to the HTTPS connector port. If only selected paths need protection, replace /* with those paths; an uncovered path remains eligible for clear-text access.
Check the resulting URL
When Tomcat performs this redirect, verify the scheme, hostname, port and original request path. If the application is directly exposed, the result should use the host that the client requested and the secure connector port. Behind a proxy, the public scheme and port depend on proxy metadata, described below.
Use an edge redirect for universal HTTP-to-HTTPS enforcement
If the requirement is “every HTTP URL redirects,” place that rule on the reverse proxy or load balancer that receives public traffic. Configure its HTTP listener to return a permanent redirect such as 301 to the same host and URI under https. Preserve the original Host and request path, and avoid constructing a target from an untrusted host header without an allowlist.
The edge should also forward the protocol information that the application needs, commonly through a forwarded-protocol header, along with the public host and port. A conceptual flow is:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Client requests
http://www.example.test/account?next=/orders. - The edge returns
301 Location: https://www.example.test/account?next=/orderswithout sending the request to Tomcat. - The client requests the HTTPS URL; the edge terminates TLS and forwards the request to Tomcat with the original host and an indication that the external scheme is HTTPS.
- Tomcat and the application generate absolute URLs and security decisions from the external scheme and port, not from the internal proxy connection.
A permanent redirect is cacheable. Test the target carefully before enabling it broadly, because a malformed host, path or forwarded-protocol rule can create a redirect loop or send users to an internal name.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Tell Tomcat about the public proxy URL
When TLS terminates before Tomcat, the internal connection may be HTTP even though the browser is using HTTPS. Configure the connector or proxy-handling valve so servlet URL generation and security calculations see the public host and port. For a fixed public endpoint, connector metadata can include values equivalent to proxyName="www.example.test" and proxyPort="443". If the proxy serves multiple hosts, use the proxy-aware configuration supported by your Tomcat version.
Tomcat must also process the forwarded scheme from a trusted proxy. Use the documented remote-address or forwarded-header handling for your release, and trust those headers only from the proxy network. If an Internet client can inject an X-Forwarded-Proto value directly, an application may incorrectly believe a clear-text request is secure.
After configuring proxy metadata, test an application page that creates an absolute link, a login form or a redirect. It should emit https and the public port. A loop in which HTTP redirects to HTTPS and HTTPS redirects back to HTTP almost always means the forwarded scheme is missing, overwritten or trusted from the wrong hop.
Choose a deployment pattern with this checklist
- Direct Tomcat: install the certificate in Tomcat, expose the HTTPS connector, keep the HTTP connector only if you need conditional or explicit redirects, and protect the host and keystore files.
- Proxy termination: keep private keys at the edge, create the universal redirect there, forward host and scheme metadata, and configure Tomcat to interpret those values safely.
- Internal encryption as well: configure a second TLS hop only when your network or compliance boundary requires it, and document which certificate each hop validates.
- Port 443: use it for the public URL when the operating system or fronting service can bind the privileged port; otherwise publish 8443 explicitly or map 443 at the edge.
- Keystore: choose it when Java-oriented certificate management and a single protected file are convenient.
- PEM: choose it when your existing certificate automation already produces separate certificate, chain and key files.
Troubleshooting SSL and redirect failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Tomcat reports “keystore was tampered with” or a password error | Wrong password, wrong keystore type, unreadable file or incorrect path | Run keytool -list with the same type, verify the path relative to $CATALINA_BASE, and confirm the service account can read the file. |
| HTTPS will not bind | Another process owns the port, the port requires privileges, or the connector XML is invalid | Check the operating-system listener table, port privileges and the complete Tomcat startup log. Validate that the connector is inside the correct <Service>. |
| Handshake or trust failure | Hostname is absent from SAN, chain is incomplete, key does not match the certificate, or the client does not trust the issuer | Inspect the presented certificate and chain, verify the public hostname, and compare the certificate and private-key identity. |
| Browser still warns after the connector starts | The certificate is self-signed, expired, issued for another hostname or chained to an untrusted authority | Replace the lab certificate with one chaining to a trust store used by clients and verify the exact hostname in the address bar. |
| An HTTP request reaches the application without redirecting | No matching CONFIDENTIAL security constraint |
Check the deployed application’s web.xml, URL pattern and transport guarantee. redirectPort alone is not a site-wide redirect. |
| Only some paths redirect | The constraint covers selected URL patterns | Review every <web-resource-collection> and decide whether the protected pattern should be expanded. |
| Redirect loop behind a proxy | Tomcat sees the internal HTTP hop instead of the external HTTPS scheme, or forwarded headers are inconsistent | Align the proxy’s forwarded-protocol header with Tomcat’s trusted-header handling and set the public proxy host and port. |
| Redirect points to an internal hostname or port | Public proxy metadata is missing or incorrect | Set the externally visible host and port, preserve the original URI, and test an application-generated absolute URL. |
| One hostname works while another shows the wrong certificate | SNI host configuration or certificate SAN coverage is incomplete | Define the required SSL host configurations and issue a certificate that includes every public name. |
Operate the configuration safely
Protect secrets and configuration
Store keystores, private keys and passwords outside locations writable by the application. Restrict file permissions, protect backups and avoid committing credentials to source control. If your deployment system injects passwords at startup, ensure they do not appear in process listings or shared logs.
Plan certificate renewal
Renew before expiry, install the replacement certificate and chain, then restart or otherwise reload the connector using the procedure supported by your Tomcat version. Test the new certificate from outside the server, including the complete chain and every public hostname. A successful file replacement does not prove that the running connector has loaded the replacement.
Make the redirect policy explicit
Document whether the application relies on Servlet constraints, an edge-level permanent redirect, or both. If both are enabled, verify that the edge redirect reaches the same public hostname and that an already secure request is never redirected again. Keep a direct HTTP test and a proxied HTTPS test in your deployment checklist.
Final validation sequence
- Confirm the certificate covers the public hostname and that the private key and chain are available in the selected format.
- Confirm the secure connector’s port, protocol,
SSLEnabledsetting and certificate attributes inserver.xml. - Restart Tomcat and resolve every startup error before testing redirects.
- Connect directly to the HTTPS listener and inspect the certificate and application response.
- If using application-controlled redirects, verify a URL covered by a
CONFIDENTIALconstraint and confirm the HTTP connector’sredirectPort. - If using universal redirects, test the edge’s HTTP response, preserved URI and public host, then test the forwarded scheme on the HTTPS-to-Tomcat hop.
- Test a hostname that should fail, an uncovered path, an expired or untrusted test certificate, and a proxy request so that failure behavior is known rather than accidental.
The reliable rule is simple: configure TLS on the component that terminates it, use redirectPort for Servlet security constraints, and put an all-URL redirect at the edge when every clear-text request must be upgraded.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
