# Tomcat SSL Configuration Generator (server.xml SSLHostConfig)

> Tomcat HTTPS connector with SSLHostConfig: TLS 1.2/1.3, ciphers, PEM or PKCS#12 certificates, HTTP/2 and HSTS filter.

Source: https://ssl.sh/tools/tls-config-generator/tomcat/
Last updated: 2026-11-10

Generate a Tomcat server.xml HTTPS connector with SSLHostConfig, PEM or PFX certificates, and the HSTS filter for web.xml.

The Tomcat preset of the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) writes an HTTPS `Connector` with an `SSLHostConfig` for `conf/server.xml` and the HSTS filter for `conf/web.xml`. Paste both, restart Tomcat and check the connector.

## Example: intermediate profile

```xml
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
    <SSLHostConfig protocols="TLSv1.2+TLSv1.3"
                   ciphers="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305"
                   honorCipherOrder="false"
                   disableSessionTickets="true">
        <Certificate certificateFile="/etc/ssl/example.com/cert.pem"
                     certificateKeyFile="/etc/ssl/example.com/privkey.pem"
                     certificateChainFile="/etc/ssl/example.com/chain.pem" />
    </SSLHostConfig>
</Connector>
```

With a PFX instead of PEM files:

```xml
<Certificate certificateKeystoreFile="conf/example.com.pfx"
             certificateKeystoreType="PKCS12"
             certificateKeystorePassword="your-password" />
```

## Version notes

- Tomcat 9.0, 10.1 and 11 support this syntax (8.5 too, now end-of-life).
- TLS 1.3 requires Java 11+. Java versions from 8u291/11.0.11 disable TLS 1.0 and 1.1 in `java.security`, so the old profile also needs that setting changed.
- Tomcat translates OpenSSL-style cipher names for the JSSE implementation, so the same `ciphers` string works with or without Tomcat Native.

## Restart and test

```bash
sudo systemctl restart tomcat
openssl s_client -connect example.com:8443 -servername example.com </dev/null | head -5
```

To serve HTTPS on port 443 directly, change the port and allow Tomcat to bind privileged ports, or put a reverse proxy in front.

## Common mistakes

- **Wrong keystore password or type**: Tomcat logs "keystore password was incorrect"; check `certificateKeystoreType="PKCS12"` for `.pfx` files.
- **Missing chain**: Java clients then fail with [PKIX path building failed](https://ssl.sh/errors/java-pkix-path-building-failed/). Set `certificateChainFile` or include the chain in the PFX.


## FAQ

**Should I use PEM files or a PFX keystore?**

Either works since Tomcat 8.5. PEM files are easier to update from ACME clients; a PKCS #12 keystore keeps everything in one password-protected file, which is what many CA and cloud downloads for Tomcat provide.

**Do I still need a JKS keystore?**

No. JKS is a legacy format. Java 9+ uses PKCS #12 as the default keystore type, and Tomcat reads PKCS #12 and PEM directly.

**Tomcat runs behind Nginx or a load balancer. Do I need this?**

Not if the proxy terminates TLS and talks to Tomcat over HTTP on a private network. Configure TLS on the proxy instead, and make Tomcat aware of the original scheme (RemoteIpValve).