Configure SSL on Tomcat 6/7/8/9

This guide helps you to easily configure SSL on Tomcat version 6, 7, 8 or 9.

Requirements

1. Certificate file issued by an authority in the PEM format. Example given below:

-----BEGIN CERTIFICATE-----
 
<base64 encoded domain cert>
 
-----END CERTIFICATE-----

2. Matching Private Key generated by us in the PEM format during the process of generating CSR. Example given below:

-----BEGIN PRIVATE KEY-----
 
<base64 encoded domain cert's key>
 
-----END PRIVATE KEY-----

3. CA certificate bundle for of the certificate issuer. It can be downloaded at issuer website. Make sure it is matching with the issued certificate type.

-----BEGIN CERTIFICATE-----
 
<base64 encoded CA cert>
 
-----END CERTIFICATE-----
 
-----BEGIN CERTIFICATE-----
 
<some CA have multiple chained certificates>
 
-----END CERTIFICATE-----

Step 1: Appending CA-Cert into Domain Certificate

We need append the CA certs in to the domain’s certificate file. The final certificate in PEM format will look like the following:

Step 2: Converting PEM to PKCS12 format

Using the openssl command-line tool, we will convert PEM format to PKCS12 (p12) format.

# openssl pkcs12 -export -in domain.com_combined.crt -inkey domain.com.key -name "domain.com" -out domain.com.p12

Where:

-in domain.com_combined.crt is the input combined CA + Domain certificate in PEM format

-inkey domain.com.key is the input private key filename in PEM format

-CAfile domain.com.ca is the input CA certificate file.

-name “domain.com” is a friendly name for the certificate inside PKCS12 file.

-out domain.com.p12 is the output filename for PKCS12 format

When prompted, enter a new export password. This password will be required to read the certificate inside the PKCS12 file.

Enter Export Password: ********
Verifying - Enter Export Password: ********

Now the PKCS12 formatted certificate will be created with filename domain.com.p12 in the current directory.

Step 3: Importing PKCS12 into a JAVA Keystore file

Java keystore is nothing but a file which can be used to store multiple certificate in a format which is understandable to JAVA (Tomcat is running using JAVA)

# keytool -importkeystore -destkeystore domain.com.jks -srckeystore domain.com.p12 -srcstoretype PKCS12 -deststoretype PKCS12

Where:

-destkeystore domain.com.jks is the output JAVA keystore filename

-srckeystore domain.com.p12 is the input PKCS12 file which we have created in Step 1.

This step will prompt for a new password for the keystore file and the previous password we used for PKCS12 file. You can use same password for both.

Enter destination keystore password: ********
Re-enter new password: ********
Enter source keystore password: ********
Entry for alias domain.com successfully imported.
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled

Step 4: Configure Tomcat to use the Keystore

Enter the following command to check the Tomcat version:

# java -cp /path/to/catalina.jar org.apache.catalina.util.ServerInfo
Server version: Apache Tomcat/7.0.30
(...)

Edit the conf/server.xml located under tomcat base directory and add the following code block inside <Service tag.

Tomcat 6:

<Connector protocol="org.apache.coyote.http11.Http11Protocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/path/to/domain.com.jks" keystorePass="my_keystore_password"
           clientAuth="false" sslProtocol="TLS" >
</Connector>

Tomcat 7 / Tomcat 8.0.x:

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/path/to/domain.com.jks" keystorePass="my_keystore_password"
           clientAuth="false" sslProtocol="TLS" >
</Connector>

Tomcat 8.5.x / Tomcat 9:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
        maxThreads="150" SSLEnabled="true" >
        <SSLHostConfig>
            <Certificate certificateKeystoreFile="/path/to/domain.com.jks"
            certificateKeystorePassword="my_keystore_password"
            type="RSA" />
        </SSLHostConfig>
</Connector>

Where:

/path/to/domain.com.jks is the absolute path to the keystore file we have created in Step 2.

my_keystore_password is the password set for keystore file in Step 2.