How to Configure SSL on Tomcat and Redirect HTTP to HTTPS

This guide walks you through enabling SSL/TLS on Apache Tomcat so your web application is served over HTTPS, and then forcing all HTTP traffic to redirect to the secure port. You will need a Java keystore containing your certificate (self-signed for testing or a CA-signed one for production) and access to Tomcat’s server.xml and web.xml configuration files.

What You’ll Need

Apache Tomcat 9 or 10 installed and running (the steps are similar for Tomcat 8.5).
A Java Development Kit (JDK) installed, because keytool is part of the JDK.
Your SSL certificate: either a self-signed certificate for testing or a certificate from a Certificate Authority (CA) for production. You’ll need the private key and the certificate chain.
Administrative access to the Tomcat installation directory (to edit conf/server.xml and conf/web.xml).
Ports 443 (HTTPS) and 80 (HTTP) available on your server, or you’ll need to adjust the port numbers.

Step-by-Step

Stop Tomcat
Before making configuration changes, stop the Tomcat service. On Linux, run sudo systemctl stop tomcat (or use the appropriate script in bin/). On Windows, use the bin\shutdown.bat script or stop the service from the Services panel.
Create a Java Keystore (JKS) or PKCS12 keystore
If you have a CA-signed certificate, you’ll need to import it into a keystore. If you’re testing, generate a self-signed certificate with keytool:
keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -validity 365 -keystore /path/to/keystore.jks -storepass changeit
For a CA-signed certificate, you typically receive a .pem or .crt file. You can convert it to PKCS12 using OpenSSL and then import it into a JKS, or use the PKCS12 file directly (Tomcat supports both).
Configure the SSL Connector in server.xml
Open conf/server.xml and locate the default HTTP connector (usually on port 8080). Below it, add a new connector for HTTPS. For Tomcat 9+, the recommended configuration is:
```
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="200"
           sslEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/path/to/keystore.jks"
                     certificateKeystorePassword="changeit"
                     type="RSA" />
    </SSLHostConfig>
</Connector>
```
If you’re using a PKCS12 keystore, add certificateKeystoreType="PKCS12" to the Certificate element. Adjust the port if you’re not using 443 (e.g., 8443 for testing).
Set the redirect port on the HTTP connector
In the same server.xml, find the HTTP connector (port 8080) and add the attribute redirectPort="443" (or the port you chose for HTTPS). This tells Tomcat where to send requests that require SSL. Example:
```
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="443" />
```
Enable automatic HTTP-to-HTTPS redirection (optional but recommended)
To force all HTTP requests to go to HTTPS, edit conf/web.xml. Add the following security-constraint inside the <web-app> element (right before the closing tag):
```
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Entire Application</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>
```
This applies to all URLs (/*) and requires that they be served over HTTPS. Tomcat will automatically redirect HTTP requests to the redirectPort.
Start Tomcat and test
Start Tomcat again. Open a browser and visit http://yourdomain.com â€“ you should be redirected to https://yourdomain.com. If you’re using a self-signed certificate, your browser will show a warning; accept it for testing.

Common Mistakes

Wrong keystore path or password â€“ Tomcat will fail to start if the keystore file is not found or the password is incorrect. Double-check the path and password in the connector.
Forgetting to set redirectPort â€“ Without it, Tomcat won’t know where to redirect HTTPS requests, and the redirection in web.xml will fail.
Using the wrong protocol â€“ For Tomcat 9+, using protocol="HTTP/1.1" is fine, but older APR-based connectors may require different configuration. Stick with the NIO protocol for simplicity.
Blocking port 443 in the firewall â€“ Even if Tomcat listens on 443, external access will fail if the firewall doesn’t allow it. Ensure port 443 is open.
Certificate chain issues â€“ With CA-signed certificates, you must include the intermediate certificates in the keystore, or browsers will show errors.

Tips

Use a PKCS12 keystore instead of JKS for better compatibility with modern tools and OpenSSL.
For production, always use a certificate from a trusted CA to avoid browser warnings.
Keep your keystore file outside the Tomcat webapps directory and set strict file permissions (e.g., 600).
If you’re behind a reverse proxy (like Nginx or Apache), you might configure SSL at the proxy level and let Tomcat handle plain HTTP internally. In that case, you don’t need the SSL connector in Tomcat, but you still need the redirection logic (either in the proxy or via the RemoteIpValve).
Test with a self-signed certificate first to verify the configuration before spending money on a CA certificate.

Troubleshooting

Tomcat fails to start with “keystore not found” â€“ Verify the file path is correct and that Tomcat’s user has read permission on the keystore.
HTTPS works but HTTP doesn’t redirect â€“ Check that the security-constraint is correctly placed in web.xml and that you edited the right web.xml (the one in conf, not the one in your application).
Browser shows “connection not private” â€“ This is expected with self-signed certificates. For production, install a valid CA certificate.
Port 443 already in use â€“ Run netstat -tulpn | grep 443 (Linux) or netstat -ano | findstr :443 (Windows) to see what’s using it. You may need to stop that service or use a different port.
HTTPS loads but images/CSS are still HTTP â€“ Your application may be generating absolute URLs with HTTP. Use relative URLs or configure Tomcat’s scheme and secure attributes on the connector to tell Tomcat the request is secure (especially when behind a proxy).

Frequently Asked Questions

Q: Can I use a free certificate like Let’s Encrypt with Tomcat?
A: Yes. You can obtain a free certificate from Let’s Encrypt, then convert it to PKCS12 format and import it into a keystore. The process is the same as with any other CA certificate.

Q: Do I need to modify my application code to support HTTPS?
A: Not usually. As long as you use relative URLs and don’t hardcode http:// links, your application will work over HTTPS. If you have absolute URLs, update them to use HTTPS or make them protocol-relative.

Q: What is the difference between JKS and PKCS12 keystores?
A: JKS is Java-specific and older; PKCS12 is a standard format that can be used by many tools. Tomcat supports both. PKCS12 is recommended for new deployments due to better security and compatibility.

Q: How do I redirect only a specific context path to HTTPS?
A: In the security-constraint, change the url-pattern to something like /secure/* to restrict the redirection to that path. You can also create multiple constraints for different paths.

Q: Why do I get a 404 after redirecting to HTTPS?
A: This usually happens if the HTTPS connector is on a different port than expected, or if the application is not deployed on that port. Check that the connector port matches the redirectPort and that your application is accessible via HTTPS.

Q: Can I disable HTTP entirely after setting up HTTPS?
A: Yes, you can comment out or remove the HTTP connector from server.xml. However, this will prevent any HTTP access, which may be fine if you only want HTTPS. If you need to keep HTTP for health checks, you can leave it but the redirection will handle it.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →