In the computer course I'm writing I'm using Tomcat for the server. (Students learn how to set up CentOS and everything from scratch. Currently the course has them using Tomcat running on port 8080.) I'm going back to write the section on security. I want students to learn to set up their web server to use SSL/TLS on port 443, with HTTP port 80 redirecting to HTTPS port 443. This should be a very basic, fundamental configuration, no?

The last time I did this myself was about 10 or 15 years ago, when I compiled Apache myself and put it in front of Tomcat using whatever connectors (I'll have to go look at my configuration from back then), purchasing outrageously priced SSL certificates and installing them manually. How I'm sure things are greatly improved. Recently I've set up Apache (I didn't have to compile it) hosting static pages directly, and using Let's Encrypt (once I figured out what I should be doing) for SSL was a breeze. It's working nicely. So I assume I'd want to use Let's Encrypt in whatever solution I prescribe to the students.

So what is the best practice, straightforward, and simple setup for Tomcat with SSL on port 443 (preferably using Let's Encrypt) with HTTP port 80 forwarding to HTTPS port 443? Do I still need to stick Apache (or Nginx?) in front of it? (The last I checked, letting Tomcat use lower port numbers was a pain, and nobody seemed to know an easy, straightforward way to do it.)

This question has an open bounty worth +50 reputation from Garret Wilson ending in 5 days.

This question has not received enough attention.

Tomcat is one of the most popular Java HTTP servers, and SSL support is unquestionably of the highest importance nowadays. Yet nobody knows how to add SSL support to Tomcat, and people downvote the question (with no explanation)?


It's possible to configure Apache Tomcat with TLS and simply change the port="8443" to port="443". It's also possible to redirect all HTTP to HTTPS with a Connector as simple as:

<Connector port="8080" protocol="HTTP/1.1" 

Using Apache or Nginx in front of Apache Tomcat might still be a good idea, because it enables you to use an external web application firewall (WAF): ModSecurity with OWASP Core Rule Set. It also makes using Let's Encrypt certificates (Certbot) a lot easier. Tomcat can run your web applications listening plain HTTP on localhost:8080 while a reverse proxy on Apache / Nginx handles the WAF functionality and TLS connections.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.