Skip to main content

SSL (HTTPS) configuration on Tomcat

The first decision when setting up SSL for the iGrafx platform is whether a proxy sits between Tomcat and the user, or Tomcat is contacted directly (usually not on the standard ports 80 and 443).

  • No proxy — use the HTTPS for Tomcat without a proxy setup as-is.
  • Apache proxy — decide whether only the user-to-proxy connection is secured, or both connections. Securing only the user-to-proxy hop is the more common case, since the proxy often runs on the same machine as Tomcat. Which Apache module to use (mod_proxy_http versus mod_jk) depends on your requirements.

Prerequisites​

  • A certificate for your domain (or a self-signed certificate for testing).
  • Access to Tomcat's conf directory, and to your proxy's configuration if you use one.

Steps​

HTTPS for Tomcat without a proxy​

Follow the Tomcat SSL how-to. A minimal configuration:

  1. Generate a keystore (use igrafx as the password for testing):

    keytool -genkey -alias tomcat -keyalg RSA

  2. In conf/server.xml, locate the SSL connector:

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS"/>

  3. Add the keystore parameters:

    keystoreFile="/home/igrafx/.keystore" keystorePass="igrafx"

  4. Comment out the APR lifecycle listener:

    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

For a pre-deployed Tomcat specifically, see Configure SSL on pre-deployed Tomcat.

HTTPS to an Apache proxy with SSL on Tomcat (both connections secured)​

First complete the no-proxy setup above, then configure SSL on Apache. Generate a key and a certificate:

openssl genrsa -out icedemo.key 1024

  • Self-signed:

    openssl req -new -key icedemo.key -out icedemo.csr
    openssl x509 -req -days 365 -in icedemo.csr -signkey icedemo.key -out icedemo.crt

  • Your own CA: for testing you can build a certificate authority — see guides such as Create a CA and certificates with OpenSSL.

Then configure Apache:

sudo mkdir /etc/apache2/ssl
sudo cp ~/ssl/icedemo.crt /etc/apache2/ssl/
sudo cp ~/ssl/icedemo.key /etc/apache2/ssl/
sudo a2enmod ssl
sudo service apache2 restart
sudo vi /etc/apache2/sites-available/igrafxproxy.conf

Add:

<VirtualHost *:443>
    ServerName icedemo
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>
    SSLEngine on
    SSLProxyVerify none
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    SSLProxyEngine On
    SSLCertificateFile /etc/apache2/ssl/icedemo.crt
    SSLCertificateKeyFile /etc/apache2/ssl/icedemo.key
    ProxyRequests Off
    ProxyPreserveHost On
    ProxyPass / https://localhost:8443/
    ProxyPassReverse / https://localhost:8443/
</VirtualHost>

For securing only the user-to-Apache hop (the more common case), see Configure SSL on Apache.