-1

In the computer course I'm writing I'm using Tomcat for the server. (Students learn how to set up CentOS and everything from scratch. Currently the course has them using Tomcat running on port 8080.) I'm going back to write the section on security. I want students to learn to set up their web server to use SSL/TLS on port 443, with HTTP port 80 redirecting to HTTPS port 443. This should be a very basic, fundamental configuration, no?

The last time I did this myself was about 10 or 15 years ago, when I compiled Apache myself and put it in front of Tomcat using whatever connectors (I'll have to go look at my configuration from back then), purchasing outrageously priced SSL certificates and installing them manually. How I'm sure things are greatly improved. Recently I've set up Apache (I didn't have to compile it) hosting static pages directly, and using Let's Encrypt (once I figured out what I should be doing) for SSL was a breeze. It's working nicely. So I assume I'd want to use Let's Encrypt in whatever solution I prescribe to the students.

So what is the best practice, straightforward, and simple setup for Tomcat with SSL on port 443 (preferably using Let's Encrypt) with HTTP port 80 forwarding to HTTPS port 443? Do I still need to stick Apache (or Nginx?) in front of it? (The last I checked, letting Tomcat use lower port numbers was a pain, and nobody seemed to know an easy, straightforward way to do it.)

1 Answer 1

2

It's possible to configure Apache Tomcat with TLS and simply change the port="8443" to port="443". It's also possible to redirect all HTTP to HTTPS with a Connector as simple as:

<Connector port="8080" protocol="HTTP/1.1" 
           redirectPort="443"/>

Using Apache or Nginx in front of Apache Tomcat might still be a good idea, because it enables you to use an external web application firewall (WAF): ModSecurity with OWASP Core Rule Set. It also makes using Let's Encrypt certificates (Certbot) a lot easier. Tomcat can run your web applications listening plain HTTP on localhost:8080 while a reverse proxy on Apache / Nginx handles the WAF functionality and TLS connections.

2
  • 1
    I would keep port >1024 and prefer reverse proxy - haproxy, nginx, apache etc. The main reason is that once you are not running tomcat as root (I hope you don't ;-) ) you may have issue with starting on ports below 1024 - "permission denied". With running tomcat on port up the 1024 you are safe even for future updates / changes. Mentioned reverse proxies are prepared and ready more or less out of the box to operate these "lower ports". Tomcat is great tool but main focus is just not to handle system reserved ports ;-).
    – Kamil J
    Mar 21, 2019 at 0:43
  • So @KamilJ, could you leave a complete answer for this question? I'm really wanting to know best practices, so if you have input on a better way, then by all means, please flesh it out in an answer that I can assign the bounty to! Mar 26, 2019 at 0:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .