Certificate Management Service:Install SSL certificates on Tomcat servers

Step 2: Install the certificate on the Tomcat server

1. Upload the extracted certificate file and password file to the conf directory of the Tomcat server.

   Note

   The installation directory of Tomcat varies based on the environment of your server. You can run the sudo find / -iname "*tomcat*" command to query the installation directory.

   You can upload the file by using the file upload feature of a remote logon tool, such as PuTTY, Xshell, and WinSCP. For more information about how to upload a file to an Alibaba Cloud Elastic Compute Service (ECS) instance, see Use Remote Desktop Connection or Windows App to transfer files to a Windows instance or Upload a file to a Linux instance.

2. Run the following command in the root installation directory of Tomcat to open the server.xml file:

   sudo vim ./conf/server.xml 

3. Configure the server.xml file based on the following configuration example:

   Important

   To prevent errors when you start Tomcat, remove the comments when you copy the code.

   The procedure for installing a certificate on Tomcat 7 is similar to that on Tomcat 8.5 and later. However, the supported Java versions and configuration file formats vary, and the specific configurations are slightly different. The following section describes how to install a certificate on Tomcat 7 and Tomcat 8.5 and later. You can select a configuration method based on your Tomcat version.

   • Tomcat 7: The Tomcat server automatically selects SSL implementation. If you use this method but cannot complete the subsequent configuration, the environment of your server may not support automatic selection of SSL implementation.

     • Configuration items

       

     • Configuration example

       PFX certificate

       <!-- Change the port based on your business requirements. Port 443 is the default port for HTTPS services. If you use a different port, you must access your website by using https://domain_name:port.  
       Set keystoreFile to the path to your certificate. 
       Set keystorePass to the password that is contained in the pfx-password.txt file. 
       For more information about other configuration items, visit the Tomcat official website. -->
       <Connector port="443"
                  protocol="HTTP/1.1"
                  SSLEnabled="true"
                  scheme="https"
                  secure="true"
                  keystoreFile="conf/domain_name.pfx"
                  keystoreType="PKCS12"
                  keystorePass="Certificate password"
                  clientAuth="false"
                  SSLProtocol="TLSv1.1+TLSv1.2+TLSv1.3"
                  ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>

       JKS certificate

       <!-- Change the port based on your business requirements. Port 443 is the default port for HTTPS services. If you use a different port, you must access your website by using https://domain_name:port.  
       Set keystoreFile to the path to your certificate. 
       Set keystorePass to the password that is contained in the jks-password.txt file. 
       For more information about other configuration items, visit the Tomcat official website. -->
       <Connector port="443"
                  protocol="HTTP/1.1"
                  connectionTimeout="20000"
                  redirectport="8443"
                  maxParameterCount="1000"
                  SSLEnabled="true"
                  scheme="https"
                  secure="true"
                  keystoreFile="conf/domain_name.jks"
                  keystoreType="JKS"
                  keystorePass="Certificate password"
                  clientAuth="false"
                  SSLProtocol="TLSv1.1+TLSv1.2+TLSv1.3"
                  ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>    

   • Tomcat 8.5 and later: Manually specify SSL implementation (JSSE-based SSL implementation).

     • Configuration items

       

     • Configuration example (The <! and > comment symbols must be removed.)

       PFX certificate

       <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
                  maxThreads="150" SSLEnabled="true"
                  maxParameterCount="1000">
           <SSLHostConfig>
               <!-- Replace conf/domain_name.pfx with the path to your certificate, and replace Certificate password with the password that is contained in the pfx-password.txt file. -->
               <Certificate certificateKeystoreFile="conf/domain_name.pfx"
                            certificateKeystorePassword="Certificate password"
                            type="RSA"/>
           </SSLHostConfig>
       </Connector>

       JKS certificate

       <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
                  maxThreads="150" SSLEnabled="true"
                  maxParameterCount="1000">
           <SSLHostConfig>
               <!-- Replace conf/domain_name.jks with the path to your certificate, and replace Certificate password with the password that is contained in the jks-password.txt file. -->
               <Certificate certificateKeystoreFile="conf/domain_name.jks"
                            certificateKeystorePassword="Certificate password"
                            type="RSA"/>
           </SSLHostConfig>
       </Connector>

4. Optional. Configure settings in the /conf/web.xml file to automatically redirect HTTP requests to HTTPS requests.

   1. Run the following command in the root installation directory of Tomcat to open the web.xml file:

      sudo vim ./conf/web.xml 

   2. Append the following configuration items to the web.xml file:

      <security-constraint>
          <web-resource-collection>
              <web-resource-name>SSL</web-resource-name>
              <url-pattern>/*</url-pattern>
          </web-resource-collection>
          <user-data-constraint>
              <transport-guarantee>CONFIDENTIAL</transport-guarantee>
          </user-data-constraint>
      </security-constraint>

5. Run the following commands in the bin directory of the Tomcat server to restart the Tomcat service:

   • Stop command

     sudo ./shutdown.sh

   • Start command

     sudo ./startup.sh

Step 3: Check whether the certificate is installed

https://yourdomain   # Replace yourdomain with the domain name that is bound to your certificate.