A lot of companies do not use end to end encryption, yet they have configurations similar to yours. BShea is correct, it will work, and a proxy is the route you want to go. Here is an example.
Tomcat has connectors, with the HTTP connector turned on by default.
Apache has the same concept, allowing for HTTP and HTTPS traffic, with HTTP enabled by default.
After setting up SSL on Apache, you have encryption while the request travels to the Apache server (normally the only publicly visible part of the transaction), forwarding requests to the Tomcat server, over an unencrypted connection. The end user still sees the request to the apache server as secure, using encryption, because the request is proxied to the Tomcat server (behind the scenes.)
Full end-to-end encryption would involve enabling the HTTPS connector on the Tomcat server, which is not complicated, thus ensuring the traffic is always encrypted when traveling across the wire. (And using HTTPS protocol in the proxy instead of HTTP)
All of this said, you don't have to have encryption on Tomcat, but you don't really want a redirect. It is simple to use the proxy. Proxy the request simply by:
ProxyPass "/therequest/url/" "http://tomcat.server.ip.or.dns:8080/"
ProxyPassReverse "/therequest/url/" "http://tomcat.server.ip.or.dns:8080/"
(Don't forget to load the proxy module, http_proxy, anything required.)
This will expose the Apache endpoint to the user, and all they will see is encrypted traffic. If you do a redirect you will be dropping out of encrypted mode for the end user. Don't do this.
Hope this helps.