There are a few questions I have regarding setting up SSL on Tomcat 9 as some of the things I've read have some inconsistencies and I'm also new to PKI. Ultimately, there are two things I'm trying to accomplish: enable SSL on Tomcat 9 for a secure websocket on a webserver and also locally for testing.

Tomcat Configuration

In server.xml, it already has a Connector commented out for SSL which looks like this

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />

On the Tomcat's "how-to", and every other article, the Connector looks like this

    port="8443" maxThreads="200"
    scheme="https" secure="true" SSLEnabled="true"
    keystoreFile="${user.home}/.keystore" keystorePass="changeit"
    clientAuth="false" sslProtocol="TLS"/>

I'm not sure which configuration to use, or even if there is a different protocol I should use. Also it seems that the connector is the only Tomcat configuration necessary, but let me know if I'm wrong.


The webserver already uses SSL for HTTPS on Apache. Since it would be the same domain, would it be an issue to use the same certificate for Tomcat/WSS too? If not, Apache uses a domain.crt, domain.key, My_CA_Bundle.ca-bundle, and ca-bundle.crt.

For the local installation, I used mkcert to create a certificate for localhost which produced localhost.pem and localhost-key.pem.

Again, I'm new to PKI. I'm not sure if I need to use a Java Keystore file, if it can use a different file type, etc. Any help would be greatly appreciated.


You must log in to answer this question.

Browse other questions tagged .