Tomcat SSL configuration generator

The Tomcat preset of the TLS config generator writes an HTTPS Connector with an SSLHostConfig for conf/server.xml and the HSTS filter for conf/web.xml. Paste both, restart Tomcat and check the connector.

Example: intermediate profile

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
    <SSLHostConfig protocols="TLSv1.2+TLSv1.3"
                   ciphers="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"
                   honorCipherOrder="false"
                   disableSessionTickets="true">
        <Certificate certificateFile="/etc/ssl/example.com/cert.pem"
                     certificateKeyFile="/etc/ssl/example.com/privkey.pem"
                     certificateChainFile="/etc/ssl/example.com/chain.pem" />
    </SSLHostConfig>
</Connector>

With a PFX instead of PEM files:

<Certificate certificateKeystoreFile="conf/example.com.pfx"
             certificateKeystoreType="PKCS12"
             certificateKeystorePassword="your-password" />

Version notes

• Tomcat 9.0, 10.1 and 11 support this syntax (8.5 too, now end-of-life).
• TLS 1.3 requires Java 11+. Java versions from 8u291/11.0.11 disable TLS 1.0 and 1.1 in java.security, so the old profile also needs that setting changed.
• Tomcat translates OpenSSL-style cipher names for the JSSE implementation, so the same ciphers string works with or without Tomcat Native.

Restart and test

sudo systemctl restart tomcat
openssl s_client -connect example.com:8443 -servername example.com </dev/null | head -5

To serve HTTPS on port 443 directly, change the port and allow Tomcat to bind privileged ports, or put a reverse proxy in front.

Common mistakes

• Wrong keystore password or type: Tomcat logs "keystore password was incorrect"; check certificateKeystoreType="PKCS12" for .pfx files.
• Missing chain: Java clients then fail with PKIX path building failed. Set certificateChainFile or include the chain in the PFX.