I distribute a Java desktop application that needs to communicate with some RESTful APIs served by embedded Tomcat within a Spring Boot webapp.

I was planning on using a self-signed certificate for communication between the desktop and the server. But if I later want to expose some public web pages needing encryption I believe I will need a commercial certificate for that.

Is it possible to use multiple certificates in Tomcat? If so, how does the server distinguish which requests are encrypted by which certificate?


The protocol itself does not allow you to host two SSL certificates on the same port on the same IP.

From the Tomcat SSL Configuration HOW-TO:

Using name-based virtual hosts on a secured connection can be problematic. This is a design limitation of the SSL protocol itself. The SSL handshake, where the client browser accepts the server certificate, must occur before the HTTP request is accessed. As a result, the request information containing the virtual host name cannot be determined prior to authentication, and it is therefore not possible to assign multiple certificates to a single IP address.

An email to the Tomcat Users List states that you can do this with "a Connector and associated keystore per IP (or IP/port) you want to secure."

This will let you serve on separate ports (e.g. publicly and for your API) and/or addresses (e.g. publicly and for your API).

It is theoretically possible to make this distinction on a per-interface or per-CIDR level before the SSL handshake (e.g. traffic from gets one cert, other traffic gets the other cert), but I don't know of any single piece of software that does this; you'd need to use port forwarding via your firewall.

To do this with simple port forwarding: Forward connections from your internal infrastructure on port 443 to local port 4443 and serve your internal SSL cert on port 4443 within Tomcat.

Note: I've never heard of this being done.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy