0

I have a Tomcat 9.0.36 running on a Ubuntu 18.04.4 LTS (virtual)machine. I am trying to configure it to use a certificate that I got from a CA. I generated successfully the keystore file using keytool, and tried to configure Tomcat to listen on port 8443 for https traffic.

The relating fields in server.xms:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

<Connector port="8443" protocol="HTTP/1.1" maxThreads="100"
       scheme="https" secure="true"
       SSLEnabled="true"
       clientAuth="false"
       sslProtocol="TLS"
       keyAlias="correctAlias"
       keystoreFile="/usr/lib/jvm/jdk-12.0.2/lib/security/keystorefile.jks"
       keystorePass="correctPassWord" />

I have tried with multiple configurations of both ports, (with or without redirectPort=..., commented out the other port etc.), and the end result is the same. On port 8080, everything works fine (when connector enabled), but on 8443, the result is:

This site can’t be reached {my ip} took too long to respond. 

netstat -plnt gives followint:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         
tcp   0  0 0.0.0.0:8080    0.0.0.0:*       LISTEN      22748/java
tcp   0  0 0.0.0.0:8443    0.0.0.0:*       LISTEN      22748/java
...

So I assume there is something that prevents server from responding, as catalina.out doesn't give any errors, just the startup information, that http-nio-8080 and http-jsse-nio-8443 have started, and everything seems to be runnig.

I am aiming for the end result to be that everything redirects to the https protocol, and nothing is unencrypted.

0

Make sure the port (8443) is allowed or opened for your IP address.

So that connection can reach from outside world.

1
  • I am working on an internal network, and by default 8080 has been open, so I don't see reason for 8443 not to be. I must consult the network admin if there is something weird going on. – Nyxeria Jul 6 '20 at 10:08
0

It seems there was something interesting going on in our network, so I ended up routing the port 443 to 8443 using

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

This seems to work. In the end, this was what I was after anyways, so I managed to solve two problems at once.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.