How to Install an SSL Certificate on Apache Tomcat (9 / 10.1 / 11)

What this guide covers

Apache Tomcat is the world's most widely used Java servlet container, powering everything from small Java web apps to enterprise Spring Boot deployments. Unlike Apache HTTP Server, Tomcat manages SSL through Java's keytool utility and a keystore file rather than PEM certificates placed on the filesystem. This guide walks through the complete installation process for the three actively supported Tomcat branches:

• Tomcat 9.0 (latest: 9.0.118) — implements Servlet 4.0 / JSP 2.3, still widely used in enterprise environments
• Tomcat 10.1 (latest: 10.1.55) — implements Servlet 6.0 / JSP 3.1, uses Jakarta EE namespace
• Tomcat 11.0 (latest: 11.0.22) — implements Servlet 6.1 / JSP 4.0, current development focus

All three active branches use the same SSLHostConfig / Certificate nested syntax in server.xml. Every command and snippet in this guide applies to all three unless noted otherwise.

Prerequisites

• Root or sudo access on the server (or equivalent Windows Administrator rights)
• Tomcat 9.0, 10.1, or 11.0 installed and running — check with: $CATALINA_HOME/bin/version.sh
• Java 11 or later installed — check with: java -version
• A domain name with an A record pointing to the server's public IP
• TCP port 8443 (or 443) open in your firewall
• An SSL certificate issued by your CA — the .crt file plus the CA bundle (or intermediate .crt files)
• The private key (.key) you used to generate the CSR — never share this file

If you have not ordered a certificate yet, see My-SSL's SSL certificate options. DV certificates are issued within minutes after domain validation. Have your issued .crt file and CA bundle ready before starting.

Certificate files you need

Your CA delivers a zip archive. Unlike Apache or Nginx, Tomcat does not read PEM files directly — you need to combine everything into a single keystore file. The table below shows what you receive and what role each file plays:

Step 1: Generate a CSR with keytool

If you have already received your certificate from the CA (you submitted a CSR externally), skip to Step 2. If you need to generate the CSR now, keytool creates a PKCS12 keystore and a CSR in one command:

# Generate a new 2048-bit RSA private key and CSR inside a PKCS12 keystore
keytool -genkeypair \
  -alias tomcat \
  -keyalg RSA \
  -keysize 2048 \
  -storetype PKCS12 \
  -keystore /opt/tomcat/keystore.p12 \
  -storepass changeit \
  -dname "CN=yourdomain.com, OU=IT, O=Your Company, L=City, ST=State, C=US" \
  -ext SAN=dns:yourdomain.com,dns:www.yourdomain.com \
  -validity 1

# Export the CSR to submit to your CA
keytool -certreq \
  -alias tomcat \
  -storetype PKCS12 \
  -keystore /opt/tomcat/keystore.p12 \
  -storepass changeit \
  -file yourdomain.csr

# Generate private key and CSR with OpenSSL
openssl req -new -newkey rsa:2048 -nodes \
  -keyout yourdomain.key \
  -out yourdomain.csr \
  -subj "/C=US/ST=State/L=City/O=Your Company/CN=yourdomain.com"

# Submit yourdomain.csr to your CA
# After issuance, continue to Step 2 to package the files into a PKCS12 keystore

Step 2: Build the PKCS12 keystore

After your CA issues the certificate, you need to package the server certificate, intermediate CA chain, and private key into a single PKCS12 file that Tomcat reads.

# 1. Combine the server cert and CA bundle into a fullchain PEM
cat your_domain.crt ca_bundle.crt > your_domain_fullchain.crt

# 2. Import the fullchain certificate into the existing keystore
#    (must use the same alias as the key — "tomcat")
keytool -importcert \
  -alias tomcat \
  -storetype PKCS12 \
  -keystore /opt/tomcat/keystore.p12 \
  -storepass changeit \
  -file your_domain_fullchain.crt \
  -trustcacerts

# Create a PKCS12 keystore from PEM files
openssl pkcs12 -export \
  -in your_domain.crt \
  -inkey your_domain.key \
  -out /opt/tomcat/keystore.p12 \
  -name tomcat \
  -CAfile ca_bundle.crt \
  -caname root \
  -chain \
  -passout pass:changeit

keytool -list -v \
  -storetype PKCS12 \
  -keystore /opt/tomcat/keystore.p12 \
  -storepass changeit

# Expected output includes:
#   Alias name: tomcat
#   Entry type: PrivateKeyEntry
#   Certificate chain length: 3  (leaf + intermediate + root)
#   Subject: CN=yourdomain.com, ...
#   Valid from: ...  until: ...

Step 3: Configure the HTTPS connector in server.xml

Open $CATALINA_HOME/conf/server.xml in a text editor. Find the commented-out HTTPS connector block (usually around line 88) and replace it with the following. The SSLHostConfig / Certificate nested syntax is required for Tomcat 9.0+ and is the only supported approach in Tomcat 11:

<!-- HTTPS connector on port 8443 (change to 443 if Tomcat has net_bind_service) -->
<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150"
           SSLEnabled="true">

  <SSLHostConfig
      protocols="TLSv1.2+TLSv1.3"
      ciphers="TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
      honorCipherOrder="false">

    <Certificate
        certificateKeystoreFile="/opt/tomcat/keystore.p12"
        certificateKeystoreType="PKCS12"
        certificateKeystorePassword="changeit"
        certificateKeyAlias="tomcat"
        type="RSA" />

  </SSLHostConfig>
</Connector>

# Grant CAP_NET_BIND_SERVICE to the JVM
sudo setcap 'cap_net_bind_service=+ep' \
  $(readlink -f $(which java))

# Then change port="8443" to port="443" in server.xml

Step 4: Force HTTP → HTTPS

There are two common approaches to redirect HTTP traffic to HTTPS in Tomcat.

<!-- Add inside <web-app> to force HTTPS for all URLs -->
<security-constraint>
  <web-resource-collection>
    <web-resource-name>Entire Application</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

Step 5: Restart Tomcat and verify

After saving server.xml, restart Tomcat and check the logs for errors before testing in a browser:

# Graceful restart (waits for active requests to finish)
$CATALINA_HOME/bin/shutdown.sh && $CATALINA_HOME/bin/startup.sh

# Or if running as a systemd service
sudo systemctl restart tomcat

# Watch the startup log for SSL errors
tail -f $CATALINA_HOME/logs/catalina.out

Look for a line like:

INFO: Starting ProtocolHandler ["https-jsse-nio-8443"]

If that line appears without errors, the HTTPS connector is active. Three ways to confirm:

openssl s_client -connect yourdomain.com:8443 -showcerts

# Look for: Verify return code: 0 (ok)
# Confirms the full certificate chain is present and trusted.

Harden TLS in Tomcat

The connector example in Step 3 already enforces TLS 1.2+ and strong cipher suites. Two additional hardening steps are recommended:

<SSLHostConfig
    protocols="TLSv1.2+TLSv1.3"
    sessionCacheSize="0"
    sessionTimeout="86400"
    disableSessionTickets="true"
    ...>

<filter>
  <filter-name>httpHeaderSecurity</filter-name>
  <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
  <init-param>
    <param-name>hstsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>hstsMaxAgeSeconds</param-name>
    <param-value>31536000</param-value>
  </init-param>
  <init-param>
    <param-name>hstsIncludeSubDomains</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>antiClickJackingEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
  <init-param>
    <param-name>xContentTypeOptionsEnabled</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>httpHeaderSecurity</filter-name>
  <url-pattern>/*</url-pattern>
  <dispatcher>REQUEST</dispatcher>
</filter-mapping>

Automate renewals — critical with 199-day certificate lifetimes

Renewal on Tomcat requires three steps each time: get the new certificate from your CA, rebuild the PKCS12 keystore, and restart Tomcat. A simple renewal script handles all three:

#!/bin/bash
# renewal-tomcat.sh — run after receiving new cert files from your CA

set -e

KEYSTORE=/opt/tomcat/keystore.p12
PASS="changeit"
ALIAS="tomcat"
CERT=./your_domain.crt
KEY=./your_domain.key
CABUNDLE=./ca_bundle.crt

# Rebuild the keystore with fresh certificate
openssl pkcs12 -export \
  -in "$CERT" -inkey "$KEY" \
  -out "$KEYSTORE" \
  -name "$ALIAS" \
  -CAfile "$CABUNDLE" -caname root -chain \
  -passout "pass:$PASS"

chmod 600 "$KEYSTORE"

# Restart Tomcat to load the new certificate
sudo systemctl restart tomcat
echo "Tomcat restarted with new certificate."

# Verify
openssl s_client -connect yourdomain.com:8443 -showcerts < /dev/null 2>&1 | \
  grep -E "(subject|issuer|Verify return)"

Set a calendar alert 30 days before expiry. For broader context on why certificate lifetimes are shrinking, read our article on 2026 SSL certificate lifetime changes. For a deep dive on the 199-day milestone specifically, see SSL certificates are now limited to 199 days.

Troubleshooting common errors

FAQ