Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OS/400 is V5R4, Java 1.6 is installed on the system, and we're using Tomcat 5.5, but we're having difficulty getting Tomcat working using HTTPS.

We created a self-signed certificate and uncommented the salient sections of the server.xml file, changing the parameters to point to the certificate (which needs to be under /QOpenSys, I believe). HTTP works, but HTTPS does not, so something is wrong, most likely with the server.xml configuration.

share|improve this question
Great - we welcome solutions to tricky issues that others may run into in the future. If memory serves, you'll need to wait for 8 hours to answer since you're under 100 rep. – Shane Madden Dec 27 '11 at 19:41
+1 to add more detail to the original question before you provide the solution. I've heard it can be a pain to set up and maintain SSL on Tomcat in general. What about using Apache to offload the SSL? – JamesA Dec 27 '11 at 21:20
up vote 2 down vote accepted

After much Googling, here's what we found:

First, ensure that your JAVA_HOME environmental variable is set:


If JAVA_HOME isn't set, add an environmental variable that points to your Java path. In my case:

JAVA_HOME = '/QOpenSys/QIBM/ProdData/JavaVM/jdk60/32bit'

If you've got your own cert already, use it; otherwise generate a self-signed certificate like so:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /QOpenSys/usr/local/ssl/test.crt

(Replace test.crt with whatever you want to call your certificate, follow the prompts)

Using WRKLNK, navigate to your Tomcat install directory's conf folder. Edit server.xml and uncomment and modify the following section:

<Connector port="8443" maxThreads="150" minSpareThreads="25"
maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https" secure="true" clientAuth="false" 
sslProtocol="TLS" keystoreFile="/QOpenSys/usr/local/ssl/test.crt" 
algorithm="IbmX509" />

Side note: We had been missing the algorithm="IbmX509" tag, which is why our previous attempts had failed.

Using QSH, navigate to your Tomcat install directory's bin folder. Start Tomcat:


Open your browser and try it out:

You'll get a warning if you're using a self-signed certificate.

If all is working as planned, go back to server.xml and disable the http access (if you want to restrict access to https).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.