|
To install an SSL certificate on Apache Tomcat on Windows, you need to acquire your certificate files, import them into the Tomcat keystore using the keytool command, and then configure your Tomcat server to use the certificate by modifying the appropriate connector within your server.xml file, finally restarting Tomcat to apply the changes. |
Key steps:
- Obtain your certificate files:
- Download your SSL certificate (.crt), intermediate certificates (if any), and private key (.key) from your certificate provider.
- Convert to PKCS12 format (optional):
- If your certificate is not in PKCS12 format, you may need to convert it using a tool like OpenSSL before importing it into the keystore.
- Access the keytool:
- Open a command prompt and navigate to your Tomcat installation directory (usually C:\apache-tomcat\bin).
- Import the certificate chain:
- Import the trusted root certificate:
| keytool -import -trustcacerts -alias rootCA -file "root_ca.crt" -keystore "your_keystore_name.jks" |
Import any intermediate certificates.
| keytool -import -trustcacerts -alias intermediate -file "intermediate.crt" -keystore "your_keystore_name.jks" |
- Import your server certificate and private key:
| keytool -import -trustcacerts -alias your_domain_name -file "your_certificate.crt" -keystore "your_keystore_name.jks" |
- Provide the keystore password when prompted .
- Configure Tomcat server.xml:
- Open the server.xml file located in tomcat_install_dir\conf.
- Find the relevant <Connector> element for your HTTPS port (usually 8443).
- Update the following attributes:
- protocol: Set to "org.apache.coyote.http11.Http11NioProtocol" or similar depending on your configuration.
- keystoreFile: Set to the path of your keystore file (e.g., "C:\apache-tomcat\keystore.jks").
- keystorePass: Set the password for your keystore.
- clientAuth: Set to "false" if you do not require client certificate authentication.
- Restart Tomcat:
- Save your changes to server.xml and restart the Tomcat service to apply the SSL configuration.
Important points:
- Keystore location: By default, Tomcat looks for a keystore named "keystore" in the Tomcat home directory.
- Password management: Ensure you securely store the password for your keystore.
- Verify your configuration: After installing the certificate, use a browser to access your website over HTTPS to verify the SSL installation is working properly.