Points To Remember

• You need to have a SSL certificate o run an application/ server on https.
• You can create a SSL certificate using keytool.
• The keystore file for Java is available in Java/jre/lib/security/cacerts.
• Default password of the keystore is "changeit".

Create a Keystore

You can make a SSL certificate by following the steps below.

1. Open a Command-line or Terminal window and make sure you're in your home directory.
2. Execute the following command in the terminal

   keytool -genkey -alias tomcat -keyalg RSA -validity 365

   NOTE, the validity parameter allows you to specify, in the number of days, how long the certificate should be valid for. The longer the time period, the less likely you are to need to recreate it. To recreate it, you'd need to delete the old one and then follow these instructions again.

3. The response will look something like this:

   Enter keystore password: 
   Re-enter new password:
   What is your first and last name?
     [Unknown]:  $MACHINE_NAME
   What is the name of your organizational unit?
     [Unknown]:  Test
   What is the name of your organization?
     [Unknown]:  Test
   What is the name of your City or Locality?
     [Unknown]:  Test
   What is the name of your State or Province?
     [Unknown]:  Test
   What is the two-letter country code for this unit?
     [Unknown]:  US
   Is CN=$FULL_MACHINE_NAME, OU=Test, O=Test, L=Test, ST=Test, C=IN correct?
     [no]:  yes

   For the keystore password you should enter "changeit" without the quotation marks.

The above steps will successfully create a keystore file by name .keystore in the home directory.

Create a Server Certificate 

Any application that wishes to securely connect to the Tomcat instance would need to import the certificate. You can export the certificate that's compatible with other JVM keystores by executing the following command:

keytool -export -alias tomcat -file server.crt

Adding Server Certificate to JVM keystore

You will now have to import the server.crt file created in the last step to the jvm's keystore, you can do it by following command.

keytool -import -file server.crt -keystore $JAVA_HOME/jre/lib/security/cacerts -alias tomcat

You need to provide the password of your keystore( default password is "changeit") to successfully import the server.crt file to the jvm cacerts.

Useful Command for using keystore.

1. Check all the certificates added to the keystore.

   keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts -v

2. Delete any certificate from keystore.

   keytool -delete -noprompt -alias ${certificate.alias}  -keystore ${keystore.file}

3. Add a certificate to the keystore.

   keytool -export -alias tomcat -file ${server.crt}

4. Change Java Keystore Password.

   keytool -storepasswd -new new_storepass -keystore keystore.jks

How to configure tomcat to run on HTTPS

Points To Remember

• You should have a war file that can be deployed to the tomcat.
• You should have tomcat installed on your machine.

Deploying a war file on Tomcat.

We hope you have a installed the tomcat or have the tomcat bundle extracted on your system. In your case we just downloaded the tomcat zip and unzipped at home location.

Step 1 : Change Tomcat User Name Password and Roles

This is done so that you can login to the Tomcat Application Manager. All you need to do is find the file tomcat-user.xml at location apache-tomcat/conf.

Edit the tomcat-users.xml file.

 Replace the following lines

<!--
  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>
-->

with the following

  <role rolename="tomcat"/>
  <role rolename="role1"/>
  <user username="tomcat" password="tomcat" roles="tomcat, manager-gui"/>
  <user username="both" password="tomcat" roles="tomcat,role1"/>
  <user username="role1" password="tomcat" roles="role1"/>

This will enable us to login to Tomcat Application Manager with user -> tomcat and password -> tomcat. Note: We assigned role -> manager-gui, without this you will not be able to authenticate.

Update the user name, password and roles

Step 2 : Logging into Tomcat Application Manager

Enter the user name and password tomcat, tomcat (or the username, password) that you have set in step 1. This will authenticate you to the Tomcat Application manger

Enter the user name password that was set in step 1

After successful login you will be able to see the following welcome screen.

Tomcat Application Manager welcome screen

Step 3 : Deploy the war file that we want.

Click on the Choose File button, and choose the war file that you want to deploy to the tomcat.

Click on Choose File to select the war file to be deployed

Choose the war file from system

Step 4: Start the application

Once the file is uploaded and deployed you will be able to see this application in the application manager. You can start, stop, reload, undeploy the war from here.

Our application test is loaded and is visible on application manager

Step 5: Run the application

Just click on the ling representing your application and it will launch our application.

Download the sample war file used for this post.