Home / Docs / Server certificate install guide (Tomcat)

Server certificate install guide (Tomcat)

From CSR to a PKCS12/JKS keystore, Connector config and backup.

Server certificate install guide (Tomcat)

Tomcat stores certificates in a Java keystore. This is the full flow — from a CSR to building the keystore, configuring the Connector and backing up.

1. Generate a private key and CSR

Option A, with OpenSSL:

openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key server.key -out server.csr

Option B, with Java keytool:

keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -keystore keystore.jks
keytool -certreq -alias tomcat -keystore keystore.jks -file server.csr

2. Build the keystore

With the OpenSSL route, pack the server certificate, intermediate and key into a PKCS12 keystore:

openssl pkcs12 -export \
  -in server.crt -certfile chain.crt -inkey server.key \
  -out keystore.p12 -name tomcat

With the keytool route, import the issued certificate back into the JKS keystore (intermediate first, then the server certificate).

3. Configure the server.xml Connector

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxThreads="200" SSLEnabled="true" scheme="https" secure="true">
  <SSLHostConfig protocols="TLSv1.2+TLSv1.3">
    <Certificate certificateKeystoreFile="conf/keystore.p12"
        certificateKeystorePassword="changeit"
        certificateKeystoreType="PKCS12" type="RSA" />
  </SSLHostConfig>
</Connector>

4. Redirect HTTP to HTTPS

Add a security constraint before </web-app> in web.xml to force HTTPS:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>All</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

5. Restart Tomcat

catalina.sh stop && catalina.sh start

6. Backup & restore

Back up the keystore file (keystore.p12 or keystore.jks) and its password. To restore, put the keystore back into the conf directory and restart Tomcat.

← Docs