Skip to main content

Configure SSL on pre-deployed Tomcat

Enable HTTPS directly on the pre-deployed Tomcat that ships with the iGrafx platform.

Prerequisites​

  • A .pfx certificate.
  • A system with OpenSSL (this guide uses Linux). If you already have .key and .crt files, skip to Configure SSL.

Steps​

Create the .key and .crt files​

Convert MyCert.pfx into MyCert.key and MyCert.crt:

openssl pkcs12 -in MyCert.pfx -nocerts -out MyCert.private.key
openssl rsa -in MyCert.private.key -out MyCert.key
openssl pkcs12 -in MyCert.pfx -clcerts -nokeys -out MyCert.crt

Copy MyCert.key and MyCert.crt to the platform server, into ...\iGrafx-Platform\igrafxdata.

Configure SSL​

Adjust server.xml and, optionally, web.xml.

server.xml (...\iGrafx-Platform\apache-tomcat-11.x.xx\conf\server.xml):

  1. In the existing HTTP connector (port="${igrafx.http.port}"), change redirectPort to 443. Keep its other attributes.
  2. Add an SSL connector below it. Replace the paths with the full paths to your MyCert.crt and MyCert.key:
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150"
           connectionTimeout="20000" URIEncoding="utf-8"
           maxParameterCount="1000000" maxPartCount="50">
    <SSLHostConfig protocols="TLSv1.2+TLSv1.3">
        <Certificate certificateFile="C:\iGrafx\iGrafxPlatform\igrafxdata\MyCert.crt"
                     certificateKeyFile="C:\iGrafx\iGrafxPlatform\igrafxdata\MyCert.key"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

Tomcat 11 no longer accepts certificate settings such as SSLCertificateFile or sslProtocol on the <Connector> itself, and it won't start if they're there. For the full list, see Upgrading server.xml for Tomcat 11.

web.xml (optional) — to make the server available over HTTPS only, add this before the closing </web-app>:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Context</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <!-- auth-constraint goes here if you require authentication -->
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Restart the iGrafx platform service for the changes to take effect.