Download and install a PFX certificate on a Tomcat server - Certificate Management Service

This topic describes how to install a PFX certificate on a Tomcat server, including downloading and uploading a certificate file, configuring related parameters on the Tomcat server, and verifying the installation result. The parameters are related to the certificate file and password file. After the certificate is installed, you can access the Tomcat server over HTTPS, which ensures the security of data transmission.

Important

This topic provides an example on how to install a PFX certificate on a Tomcat 9.0 server that runs a Linux operating system. The installation process may vary based on the version of the operating system or web server. If you have questions, contact your account manager.

Prerequisites

A certificate is issued by using the Certificate Management Service console. For more information, see Purchase SSL certificates and Apply for a certificate.
Domain Name System (DNS) resolution is complete on the domain name that is bound to the certificate. The domain name is resolved to an IP address. You can use the DNS verification tool to check whether the DNS record of the domain name takes effect. For more information, see Verify the DNS record of your domain name.
Port 443 is enabled on your web server. Port 443 is the standard port used for HTTPS communication.
If you use an Alibaba Cloud Elastic Compute Service (ECS) instance, make sure that an inbound security group rule is configured to allow TCP access on port 443. For more information, see Add a security group rule.

Step 1: Download the certificate

Log on to the Certificate Management Service console.
In the left-side navigation pane, choose Manage Certificates > SSL Certificate Management.
On the SSL Certificates page, find the certificate that you want to manage and click Download in the Actions column.
Find Tomcat in the Server Type column and click Download in the Actions column.

Decompress the downloaded certificate package.

The following table describes the files that you can extract from the package. The files vary based on the certificate signing request (CSR) generation method that you use when you submit the certificate application.

Value of the CSR Generation parameter	File extracted from the certificate package
Automatic	Certificate file in the PFX format: By default, the certificate file is named in the Certificate ID_Domain name bound to the certificate format. Password file in the TXT format: By default, the password file is named in the Certificate format-password format. Important A new password file is generated each time you download a certificate. The password is valid only for the downloaded certificate.
Manual	If you specify a CSR that is created in the Certificate Management Service console, the certificate file that is extracted from the downloaded certificate package is the same as the certificate file that is obtained in scenarios when you set CSR Generation to Automatic. If the specified CSR is not created in the Certificate Management Service console, only the PEM certificate file can be extracted from the downloaded certificate package. The password file or private key file cannot be extracted. You can use the certificate toolkit to convert your certificate file, password file, or private key file to the required format. For more information about how to convert certificate formats, see Convert the format of a certificate.

Step 2: Install the certificate on the Tomcat server

Upload the extracted certificate file and password file to the conf directory of the Tomcat server.
Note
The installation directory varies based on the environment of your server. You can run the sudo find / -name *tomcat* command to query the installation directory.
You can upload the file by using the file upload feature of a remote logon tool, such as PuTTY, Xshell, and WinSCP. For more information about how to upload a file to an Alibaba Cloud Elastic Compute Service instance, see Upload files to or download files from a Windows instance or Upload a file to a Linux instance.
Run the following command in the root installation directory of Tomcat to open the server.xml file:
```
vim ./conf/server.xml 
```

Configure the server.xml file based on the following configuration examples.

Important

To prevent errors when you start Tomcat, remove the comments when you copy the code.

You can use one of the following methods to specify SSL implementation:

Method 1: The Tomcat server automatically selects SSL implementation. If you use this method but cannot complete the subsequent configuration, the environment of your server may not support automatic selection of SSL implementation.

Configuration items

Configuration example

<Connector port="443"   # Change the port based on your business requirements. Port 443 is the default port for HTTPS services. If you use a different port, you must access your website by using https://domain_name:port. 
    protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="conf/domain_name.pfx" # Specify the path to your certificate. 
    keystoreType="PKCS12"
    keystorePass="Certificate password"  # Enter the content in the pfx-password.txt file. 
    clientAuth="false"
	
    SSLProtocol="TLSv1.1+TLSv1.2+TLSv1.3"   
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>

Method 2: Manually specify SSL implementation (JSSE-based SSL implementation).

Configuration items

Configuration example (The <! and > comment symbols must be removed.)

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true"
               maxParameterCount="1000"
               >
        <SSLHostConfig>
                <Certificate certificateKeystoreFile="conf/domain_name.pfx" # Specify the path to your certificate. 
                             certificateKeystorePassword="Certificate password" # Enter the content in the pfx-password.txt password file. 
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

Optional. Configure settings in the /conf/web.xml file to automatically redirect HTTP requests to HTTPS requests.

Run the following command in the root installation directory of Tomcat to open the web.xml file:
```
vim ./conf/web.xml 
```

Append the following configuration items to the web.xml file:

<security-constraint> 
         <web-resource-collection > 
              <web-resource-name >SSL</web-resource-name>  
              <url-pattern>/*</url-pattern> 
       </web-resource-collection> 
       <user-data-constraint> 
                    <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
       </user-data-constraint> 
    </security-constraint>

Run the following commands in the bin directory of the Tomcat server to restart the Tomcat service:
- Stop command
```
./shutdown.sh
```
- Start command
```
./startup.sh
```

Step 3: Check whether the certificate is installed

After you install a certificate, you can access the domain name that is bound to the certificate to verify whether the certificate is installed.

https://yourdomain   # Replace yourdomain with the domain name that is bound to your certificate.

If a lock icon appears in the address bar, the certificate is installed.

image..png

References

After I deploy a certificate to a website, the certificate does not take effect or the website is reported as insecure when I access the website. What do I do?