Skip to main content

Configure SSL on pre-deployed Tomcat

Enable HTTPS directly on the pre-deployed Tomcat that ships with the iGrafx platform.

Prerequisites​

  • A .pfx certificate.
  • A system with OpenSSL (this guide uses Linux). If you already have .key and .crt files, skip to Configure SSL.

Steps​

Create the .key and .crt files​

Convert MyCert.pfx into MyCert.key and MyCert.crt:

openssl pkcs12 -in MyCert.pfx -nocerts -out MyCert.private.key
openssl rsa -in MyCert.private.key -out MyCert.key
openssl pkcs12 -in MyCert.pfx -clcerts -nokeys -out MyCert.crt

Copy MyCert.key and MyCert.crt to the platform server, into ...\iGrafx-Platform\igrafxdata.

Configure SSL​

Adjust server.xml and, optionally, web.xml.

server.xml (...\iGrafx-Platform\apache-tomcat-9.0.xxx\conf\server.xml) — comment out the existing connector and add an SSL connector below it, with the correct paths to MyCert.crt and MyCert.key:

<!-- <Connector port="${igrafx.http.port}" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" URIEncoding="utf-8" /> -->

<Connector port="${igrafx.http.port}" redirectPort="443" />
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLSv1" SSLCertificateFile="..\..\igrafxdata\MyCert.crt" SSLCertificateKeyFile="..\..\igrafxdata\MyCert.key" connectionTimeout="20000" URIEncoding="utf-8" />

web.xml (optional) — to make the server available over HTTPS only, add this before the closing </web-app>:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Context</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <!-- auth-constraint goes here if you require authentication -->
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Restart the iGrafx platform service for the changes to take effect.