🎯 Purpose

This article provides high‑level guidance for enabling HTTPS/SSL on Apache Tomcat 10.1.x.
Because Tomcat is a third‑party application server, SSL configuration is outside the scope of our product support.
The content below summarizes and redirects to the official Apache Tomcat documentation.

Official SSL documentation from Apache Tomcat:
📘 https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html

1️⃣ Requirements for HTTPS on Tomcat

To configure HTTPS, Tomcat requires:

🔐 A Private Key

Generated locally on your server (via keytool or OpenSSL).
It must remain confidential.

📄 An SSL Certificate

Provided by a Certificate Authority (CA), Let’s Encrypt, or self‑signed for testing.

🔗 How They Relate

The private key and certificate form a cryptographic pair:

• The certificate contains the public key
• The private key stays on the server
• Browsers trust the certificate only if it matches the private key and is CA‑signed

Tomcat explains this relationship in its SSL introduction:
📘 https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#Introduction_to_SSL

2️⃣ High‑Level Steps to Enable HTTPS

Full details are available in Tomcat’s official SSL/TLS guide:
📘 https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#Configuration

✔️ Summary of the process

1. Generate a private key and keystore
   (Java keytool commands are provided in the Tomcat documentation.)
2. Import your SSL certificate
   It must be added to the same keystore as the private key.
3. Update Tomcat’s server.xml
   Configure an HTTPS connector using the format required by Tomcat 10.x.
4. Restart Tomcat
   So the new SSL configuration takes effect.

As details vary depending on the environment, we recommend following only the official Tomcat instructions.

3️⃣ Tomcat 9 vs Tomcat 10: SSL Configuration Differences 🆚

While the SSL concepts remain the same, Tomcat 10 uses a new SSL configuration structure that differs from Tomcat 9:

🛠️ Tomcat 9 (older syntax)

Used direct connector attributes such as:

keystoreFile=
keystorePass=

🛠️ Tomcat 10 (required format)

Uses the modern <SSLHostConfig> and <Certificate> components.

This change is documented by Apache:
📘 https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#Configuration

➡️ If your environment previously used Tomcat 9, you must update your connector configuration when moving to Tomcat 10.

4️⃣ Troubleshooting & Support Scope ⚠️

Because SSL/HTTPS setup depends on your infrastructure (certificate provider, OS configuration, firewalls, Tomcat installation), our support team cannot assist in configuring or troubleshooting third‑party SSL settings.

Useful resources:

• Tomcat SSL troubleshooting guide
  📘 https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#Troubleshooting
• Java keytool documentation
  📘 https://docs.oracle.com/en/java/javase/17/docs/specs/man/keytool.html

📚 Official References

• SSL/TLS Configuration in Tomcat 10.1:
  https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html
• Tomcat Configuration Reference:
  https://tomcat.apache.org/tomcat-10.1-doc/config/http.html
• Let’s Encrypt (certificate authority):
  https://letsencrypt.org/