Configure SSL on predeployed tomcat

Requirements

• .pfx certificate 

• System with OpenSSL (this guide will use a Linux System)

Create .key and .crt files

With OpenSSL available one a Linux system we can convert the MyCert.pfx file into MyCert.key and MyCert.crt.

/tmp$ openssl pkcs12 -in MyCert.pfx -nocerts -out MyCert.private.key

/tmp$ openssl rsa -in MyCert.private.key  -out MyCert.key

/tmp$ openssl pkcs12 -in MyCert.pfx -clcerts -nokeys -out MyCert.crt

Copy the files MyCert.key and MyCert.crt to the Server that is running the iGrafx Platform into the folder

...\iGrafx-Platform\igrafxdata

Configure SSL

Adaptions for server.xml and web.xml are necessary to enable SSL.

server.xml

Comment out the connector from server.xml by adding <!-- and --> before resp. after the Connector tag. 

...\iGrafx-Platform\apache-tomcat-9.0.107\conf\server.xml

    <!--
    <Connector port="${igrafx.http.port}" protocol="HTTP/1.1"
				connectionTimeout="20000"
				redirectPort="8443"
				URIEncoding="utf-8" />
    -->

Add the following code below the commented out section. Make sure to specify the correct path for MyCert.crt and MyCert.key

...\iGrafx-Platform\apache-tomcat-9.0.107\conf\server.xml

    <Connector port="${igrafx.http.port}" redirectPort="443" />

    <Connector port="443" protocol="HTTP/1.1"
            SSLEnabled="true"
            maxThreads="150"
			scheme="https" secure="true"
            clientAuth="false" sslProtocol="TLSv1"           
			SSLCertificateFile="..\..\igrafxdata\MyCert.crt"           
			SSLCertificateKeyFile="..\..\igrafxdata\MyCert.key"
            connectionTimeout="20000"
            URIEncoding="utf-8" /> 

web.xml

If the webserver should only be available through https and not http anymore, web.xml has to be adapted. Add the following code before the last line </web-app> 

...\iGrafx-Platform\apache-tomcat-9.0.107\conf\web.xml

<security-constraint>
    <web-resource-collection>
      <web-resource-name>Protected Context</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <!-- auth-constraint goes here if you require authentication -->
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

</web-app>

Restart the iGrafx Platform service for the changes to take effect.

This article contains

Related articles