How to install an SSL/TLS certificate on Tomcat
The instructions below walk you through installing SSL on Tomcat. If you have more than one server or device, you will need to install the certificate on each one you want to protect. If you have not generated your certificate or finished validation yet, see our CSR generation instructions and skip the steps below.
What you will need
1. Your server certificate
This is the certificate the certificate authority issued for your domain. It may have been emailed to you. If not, you can download it from your account dashboard by clicking on your order.
2. Your intermediate certificates
These files let devices connecting to your server identify the issuing certificate authority. There may be more than one of them. If your certificate arrived in a ZIP folder, the intermediates — sometimes called the CA bundle — should be in there too. If not, download the right CA bundle for your certificate.
3. Your private key
This file should be on your server, or in your hands if you generated your CSR with a free generator tool. On some platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server keeps track of it.
Installation instructions
1. Convert your certificate files
Convert your certificate files from PEM (.cer or .crt) to PKCS#7 (.p7b) format. You can do this on your own machine with this OpenSSL command:
openssl crl2pkcs7 -nocrl -certfile certificate.cer -out certificate.p7b -certfile CACert.cer
2. Go to your directory
Go to the same directory where you saved the keystore and the certificate signing request (CSR).
Note: the certificate has to be installed into the same keystore and under the same alias name. Otherwise you will hit problems during installation and may have to start again.
3. Run the install command
Install the certificate into that keystore by running:
keytool -import -trustcacerts -alias server -file your_file_name.p7b -keystore your_domain_name.jks
Note: replace "your_domain_name" with the primary domain you are protecting, and "your_file_name" with the name of the PKCS#7 file you just converted and saved.
4. Check the confirmation message
You should see this confirmation: "Certificate reply was installed in keystore" .
5. Enter Y
Enter Y or Yes when asked whether to trust the certificate. Note: your keystore now has the right certificate files to serve SSL/HTTPS on your Tomcat server.
6. Configure an SSL connector
Now you need to configure an SSL connector , which is what lets the server accept secure connections.
7. Open the .xml file
Open your server's .xml file in a plain text editor such as Notepad.
Note: the .xml file is usually in the conf folder in your server's home directory.
8. Find your connector
Find the connector you want to secure with the new keystore.
Note: the connector in use is usually on port 443 or 8443.
9. Uncomment the connector
Uncomment the connector if you need to, by removing the comment tags (<!-- and -->).
10. Enter the keystore filename and password
Enter the correct keystore filename and password . Here is our example:
<Connector port="443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true" clientAuth="false" sslProtocol="TLS" keyAlias="server" keystoreFile="/home/user_name/your_domain_name.jks" keystorePass="your_keystore_password" />
Note: on versions older than Tomcat 7, change "keystorePass" to "keypass".
11. Save your changes
Save every change you made to the .xml file.
12. Restart Tomcat
Restart your Tomcat server to finish the installation.
That is it — your SSL certificate is installed. To check your work, open the site in your browser at https://yourdomain.tld and look at the certificate and site information to confirm HTTPS is working properly. Remember that you may need to restart your server before the changes take effect.
To check your installation properly, use our SSL Checker. If something does not add up, get in touch and we will look at it with you.
