The usual secure design is to let Apache HTTP Server or NGINX terminate public HTTPS, then reverse-proxy requests to Tomcat. Apache uses mod_ssl for TLS and mod_proxy for routing; NGINX uses an HTTPS server block, an upstream group and proxy_pass. You can keep the internal hop as HTTP on a tightly controlled network or encrypt it with HTTPS as well.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Tomcat can also terminate TLS itself. That is useful when the application server must own the certificate or policy requires encryption on every hop, but it places certificate management and public-facing TLS settings inside Tomcat. The right choice depends on certificate ownership, backend trust validation, load balancing, WebSockets and the accuracy of the HTTPS information Tomcat passes to applications.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesChoose where TLS terminates
TLS termination is the point at which a component presents the public certificate, performs the handshake and decrypts the request. A reverse proxy is normally the public listener, while Tomcat listens on a private address. There are three practical layouts.
| Layout | Client-to-edge | Edge-to-Tomcat | Best fit | Main trade-off |
|---|---|---|---|---|
| Apache or NGINX termination | HTTPS | HTTP on a protected network | One proxy, centralized certificates and simple operations | The internal request is not encrypted, so the network segment must be controlled. |
| End-to-end encrypted proxying | HTTPS | HTTPS | Untrusted, shared or compliance-sensitive networks | You must issue, install and validate a certificate for Tomcat as well as the public certificate. |
| Direct Tomcat TLS | HTTPS to Tomcat | Not applicable | Small deployments or environments in which Tomcat owns the complete TLS policy | Certificate renewal, cipher policy and public traffic handling remain in Tomcat. |
Terminating at the proxy usually makes it easier to centralize renewal, redirect HTTP to HTTPS and distribute traffic across several Tomcat instances. Encrypt the second hop when traffic can be observed or altered between the proxy and application server. Do not treat an internal IP address alone as a trust boundary.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare certificates, names and network access
Use the public hostname in the edge certificate
Obtain a certificate whose subject names cover the hostname users enter, such as app.example.com. Install the matching private key on the component that terminates public TLS, and restrict the key so only the proxy service account and administrators can read it. A certificate for the proxy’s private IP or for the Tomcat-only hostname will not satisfy clients connecting to the public name.
Separate public and backend endpoints
Give Tomcat a private listening address and port, for example 127.0.0.1:8080 on a single host or a private address reachable only from the proxy. Permit that port through the host firewall only from the proxy when possible. If Tomcat uses HTTPS, choose a backend DNS name that appears in its certificate; certificate-name validation is much easier when the proxy connects using that name rather than an address.
Decide how redirects and absolute URLs should look
Applications commonly build redirects from request.getServerName(), request.getServerPort() and the secure-request flag. A proxy must therefore pass the public host and HTTPS scheme to Tomcat, and Tomcat may need proxyName, proxyPort, scheme and secure settings. Plan this before testing login flows; an apparently working page can still redirect users to an internal hostname or an HTTP URL.
Configure Apache as the HTTPS reverse proxy
Apache’s mod_ssl provides SSL v3 and TLS v1.x support for the HTTP server, while mod_proxy and mod_proxy_http forward HTTP requests. The Apache reference is at https://httpd.apache.org/docs/current/mod/mod_ssl.html. Enable those modules using your operating system’s module-management method, then place the directives below in the HTTPS virtual host.
Proxy to an HTTP Tomcat connector
This example publishes Tomcat under /app/. Keep the trailing slashes paired so Apache does not unexpectedly rewrite the path.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
<VirtualHost *:443>
ServerName app.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/app.example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/app.example.com/privkey.pem
ProxyRequests Off
ProxyPass /app/ http://127.0.0.1:8080/app/
ProxyPassReverse /app/ http://127.0.0.1:8080/app/
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
</VirtualHost>ProxyRequests Off prevents the server from acting as a forward proxy. It is not necessary to enable ProxyRequests for reverse proxying. ProxyPassReverse changes redirect headers generated by Tomcat so clients continue to use the public URL.
Recommended Free Tools
If the application is served at the site root, map / to Tomcat’s root context instead. Before reloading Apache, validate the configuration with your platform’s syntax-check command, then reload rather than stopping the service. Confirm that the certificate chain presented on port 443 is complete and that the backend port is reachable from the Apache host.
Proxy to an HTTPS Tomcat connector
Change the upstream URL to https:// and enable Apache’s proxy TLS engine inside the virtual host:
SSLProxyEngine on
SSLProxyVerify require
SSLProxyCheckPeerName on
SSLProxyCheckPeerExpire on
ProxyPass /app/ https://tomcat.internal.example:8443/app/
ProxyPassReverse /app/ https://tomcat.internal.example:8443/app/SSLProxyEngine is disabled by default. Apache’s SSLProxyCheckPeerName defaults to on; if the backend certificate name does not match the hostname Apache uses, the proxy returns a 502 response. Keep hostname and expiry checks enabled. Install the issuing CA certificate in Apache’s trusted store when the Tomcat certificate is private or internally issued, and fix the name or trust chain rather than disabling validation. A temporary exception should be documented, narrowly scoped and removed after the certificate problem is corrected.
Handle an HTTP-to-HTTPS redirect
Run a separate port-80 virtual host that redirects to the canonical HTTPS URL. Do not proxy application traffic over the clear-text listener unless that is an intentional exception. The redirect should preserve the path and query string, while the HTTPS virtual host remains the only place where the application is served.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure NGINX as the HTTPS reverse proxy
One Tomcat instance
Define an upstream group and reference it from an HTTPS server block. The upstream can contain one address today and several later without changing the public URL.
upstream tomcat {
server 127.0.0.1:8080;
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/ssl/app.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/app.example.com/privkey.pem;
location /app/ {
proxy_pass http://tomcat;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
}
}With this form of proxy_pass, NGINX forwards the request URI to the upstream. Test the final path behavior against the context path actually deployed in Tomcat; a mismatch commonly produces a 404 even though TLS is working.
Several Tomcat instances
List each backend in the upstream group and select a balancing policy appropriate to the application. The default distribution is often sufficient for stateless requests. Applications that keep user state in memory may need session replication, a shared session store or deliberately consistent routing; encryption does not solve session-state problems.
upstream tomcat {
server tomcat-a.internal.example:8080;
server tomcat-b.internal.example:8080;
}
Check each instance independently before placing it in rotation. Remove an unhealthy node from service rather than allowing repeated proxy timeouts to become the user’s error page.
Proxy to HTTPS Tomcat
Use an HTTPS upstream and configure certificate verification. A representative location is:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
location /app/ {
proxy_pass https://tomcat;
proxy_http_version 1.1;
proxy_ssl_server_name on;
proxy_ssl_name tomcat.internal.example;
proxy_ssl_verify on;
proxy_ssl_trusted_certificate /etc/nginx/tomcat-ca.pem;
proxy_ssl_verify_depth 2;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Port 443;
}The trusted CA file must contain the authority that issued the Tomcat certificate, and the name supplied for verification must match that certificate. Do not turn verification off merely to make an internal certificate work; correct the certificate name or install the appropriate CA.
Support WebSockets when the application uses them
WebSocket handshakes require HTTP/1.1 upgrade headers to survive the proxy. Add an explicit map and headers in the NGINX configuration when the application needs WebSockets:
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
location /app/ {
proxy_pass http://tomcat;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
}Use the equivalent upgrade-aware proxy configuration in Apache if the application has WebSocket endpoints. Test an actual WebSocket connection, not only the initial HTML page.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Enable TLS directly in Tomcat
Tomcat’s HTTP connector enables TLS with SSLEnabled="true". Set scheme="https" and secure="true" so servlets receive the correct secure-request values. A secure connector must define at least one SSLHostConfig and certificate configuration. NIO and NIO2 connectors can use JSSE or OpenSSL implementations.
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443"
SSLEnabled="true"
scheme="https"
secure="true">
<SSLHostConfig>
<Certificate
certificateFile="/etc/tomcat/tls/fullchain.pem"
certificateKeyFile="/etc/tomcat/tls/privkey.pem"
type="RSA" />
</SSLHostConfig>
</Connector>Use a certificate whose name matches the hostname clients use when they connect directly. Protect the key with filesystem permissions, keep the connector off the public interface when a proxy is in front, and restart or reload Tomcat according to the deployment’s normal configuration procedure.
Set proxy metadata when Tomcat is behind an edge
If Apache or NGINX accepts https://app.example.com but Tomcat listens on port 8080, configure the connector or service so Tomcat knows the public identity:
<Connector
port="8080"
scheme="https"
secure="true"
proxyName="app.example.com"
proxyPort="443" />proxyName and proxyPort affect request.getServerName() and request.getServerPort(). Use them when the application generates absolute links, redirects or cookie-related URLs from those values. They do not encrypt the hop; encryption is determined by whether the proxy connects to an HTTP or HTTPS Tomcat connector.
Free tools Windows power users keep installed
One-click scans. No signup required.
Forward the right request headers
The proxy should preserve the public host and tell Tomcat that the original request was secure. Common headers are Host, X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Port. Configure Tomcat or the application framework to trust these headers only from the known proxy network. Otherwise a client could submit forged values and influence redirects, logging or access-control decisions.
Do not blindly append forwarding headers from an untrusted external connection. The edge should overwrite or sanitize them, then the backend should accept the resulting values only from that edge.
Verify the complete path
- Check the proxy configuration syntax and reload the service without interrupting existing connections where supported.
- From a client network, open the public hostname and inspect the certificate subject, chain, expiry and negotiated hostname. Confirm that an HTTP request redirects to the intended HTTPS URL.
- Use a header request such as
curl -I https://app.example.com/app/and verify the status,Locationheader and absence of an internal hostname or port. - From the proxy host, test the Tomcat listener separately. For an HTTP backend, request its private URL; for an HTTPS backend, use a TLS client that validates the backend name and issuing CA.
- Sign in and exercise redirects, sessions, secure cookies, file uploads, downloads and any absolute links. These reveal incorrect scheme, host or port metadata.
- If the application uses WebSockets, open a real socket and leave it connected long enough to detect idle-timeout or upgrade failures.
- Review proxy and Tomcat logs together. A 502 or 504 at the edge usually means a connection, TLS validation or timeout problem between proxy and Tomcat, not a public certificate problem.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| Browser reports a certificate warning | Wrong hostname, incomplete chain, expired certificate or incorrect certificate bound to the listener | Inspect the certificate served on the public port and compare names, dates and chain files with the configured material. |
| Apache returns 502 for an HTTPS backend | Backend name validation failed, the CA is untrusted, the certificate expired or Tomcat is unreachable | Read the Apache error log, connect using the exact backend hostname and keep SSLProxyCheckPeerName and expiry checks enabled. |
| NGINX returns 502 or 504 | Wrong upstream port, firewall block, refused connection, TLS verification failure or backend timeout | Test the upstream from the NGINX host, verify the certificate name and inspect the NGINX error log. |
| Redirects point to HTTP or an internal port | Tomcat does not know the original scheme, host or public port | Pass forwarding headers and set scheme, secure, proxyName and proxyPort as appropriate. |
| Every proxied URL gains or loses a path segment | Trailing-slash mismatch or an incorrect Tomcat context path | Compare the public location, ProxyPass/proxy_pass target and deployed context exactly. |
| WebSocket handshake fails | Upgrade headers were not forwarded or the request was routed to an incompatible backend | Use HTTP/1.1, forward Upgrade and Connection, and test the socket endpoint directly. |
| Tomcat works directly but not through the proxy | Backend access rules, host-header handling, path mapping or proxy-only firewall rules | Compare a direct backend request with the proxied request and inspect both services’ logs. |
Operational security checklist
- Keep private keys readable only by the service account and administrators.
- Automate certificate renewal where possible, and reload the proxy after renewal so it serves the new certificate.
- Use HTTPS on the backend when the network is shared, physically exposed, separately administered or subject to an encryption requirement.
- Validate backend certificate names, trust chains and expiry dates; do not make verification-off settings permanent.
- Close direct public access to Tomcat when the proxy is the intended entry point.
- Trust forwarding headers only from the proxy and record the original client address safely.
- Test redirects, cookies, uploads, WebSockets and failure behavior after every certificate, proxy or Tomcat connector change.
- Keep Apache, NGINX, Tomcat and their TLS libraries maintained; defaults and supported protocol details change between releases.
Which design should you use?
For most installations, terminate public TLS at Apache or NGINX and proxy to Tomcat over HTTP only when the private network is genuinely controlled. Use HTTPS for the second hop when confidentiality must continue through the infrastructure. Choose direct Tomcat TLS when Tomcat must own certificates or when a proxy is not part of the deployment. Whichever layout you select, make the public hostname, HTTPS scheme and secure-request state consistent from the browser through the proxy to the application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
