0

I have a Tomcat 9.0.36 running on a Ubuntu 18.04.4 LTS (virtual)machine. I am trying to configure it to use a certificate that I got from a CA. I generated successfully the keystore file using keytool, and tried to configure Tomcat to listen on port 8443 for https traffic.

The relating fields in server.xms:

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

<Connector port="8443" protocol="HTTP/1.1" maxThreads="100"
       scheme="https" secure="true"
       SSLEnabled="true"
       clientAuth="false"
       sslProtocol="TLS"
       keyAlias="correctAlias"
       keystoreFile="/usr/lib/jvm/jdk-12.0.2/lib/security/keystorefile.jks"
       keystorePass="correctPassWord" />

I have tried with multiple configurations of both ports, (with or without redirectPort=..., commented out the other port etc.), and the end result is the same. On port 8080, everything works fine (when connector enabled), but on 8443, the result is:

This site can’t be reached {my ip} took too long to respond. 

netstat -plnt gives followint:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         
tcp   0  0 0.0.0.0:8080    0.0.0.0:*       LISTEN      22748/java
tcp   0  0 0.0.0.0:8443    0.0.0.0:*       LISTEN      22748/java
...

So I assume there is something that prevents server from responding, as catalina.out doesn't give any errors, just the startup information, that http-nio-8080 and http-jsse-nio-8443 have started, and everything seems to be runnig.

I am aiming for the end result to be that everything redirects to the https protocol, and nothing is unencrypted.

2 Answers 2

0

Make sure the port (8443) is allowed or opened for your IP address.

So that connection can reach from outside world.

2
  • I am working on an internal network, and by default 8080 has been open, so I don't see reason for 8443 not to be. I must consult the network admin if there is something weird going on.
    – Nyxeria
    Jul 6, 2020 at 10:08
  • @Nirmal How can I check port (8443) is allowed or opened??
    – KJEjava48
    Feb 22 at 6:59
0

It seems there was something interesting going on in our network, so I ended up routing the port 443 to 8443 using

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8443

This seems to work. In the end, this was what I was after anyways, so I managed to solve two problems at once.

1
  • how can I undo this after routing 443 to 8443??
    – KJEjava48
    Feb 22 at 7:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .