如何使用PEM文件在Tomcat 8上配置HTTPS（启用SSL）

Hey there! Let's get your Tomcat 8 server set up with HTTPS using your .pem certificate. Since Tomcat natively works with Java keystore formats (PKCS12 or JKS), we’ll first convert your PEM files into a compatible keystore, then tweak Tomcat’s configuration. Here’s a step-by-step guide:

Step 1: Gather Your PEM Files #

Make sure you have all necessary files handy:

• Your primary certificate file (e.g., cert.pem)
• Your private key file (e.g., privkey.pem)
• Optional: CA chain file (e.g., chain.pem) if your certificate authority provided one

Step 2: Convert PEM to PKCS12 Keystore #

PKCS12 is a universal keystore format that Tomcat 8 supports natively, so this is the easiest path. Use the openssl command to convert your files:

openssl pkcs12 -export -in cert.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root

Let’s break down the parameters:

• -export: Tells OpenSSL to create a PKCS12 keystore
• -in: Path to your certificate file
• -inkey: Path to your private key file
• -out: Path and name for the output PKCS12 keystore
• -name tomcat: Sets an alias for the certificate (Tomcat looks for this alias by default)
• -CAfile/-caname: Include these if you have a CA chain file to ensure full certificate chain trust

When prompted, set a keystore password (remember this—you’ll need it for Tomcat’s config). For simplicity, use the same password for the keystore and private key when asked.

If you don’t have a CA chain file, use this simplified command:

openssl pkcs12 -export -in cert.pem -inkey privkey.pem -out keystore.p12 -name tomcat

Optional: Convert PKCS12 to JKS #

If you prefer to use the older JKS format, convert the PKCS12 keystore with the keytool command (included with Java):

keytool -importkeystore -srckeystore keystore.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS

You’ll be asked for the PKCS12 password and to set a new JKS password.

Step 3: Update Tomcat’s server.xml Configuration #

Navigate to your Tomcat installation directory, open conf/server.xml in a text editor. Look for the commented-out HTTPS <Connector> section (or add a new one if it’s missing).

For PKCS12 Keystore #

Replace the default HTTPS Connector with this configuration:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/absolute/path/to/keystore.p12"
                     type="RSA"
                     certificateKeystorePassword="your-keystore-password"
                     certificateKeystoreType="PKCS12"/>
    </SSLHostConfig>
</Connector>

For JKS Keystore #

If you converted to JKS, use this instead:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/absolute/path/to/keystore.jks"
                     type="RSA"
                     certificateKeystorePassword="your-jks-password"
                     certificateKeystoreType="JKS"/>
    </SSLHostConfig>
</Connector>

Key notes for the config:

• port="8443": Default HTTPS port (you can change this if needed)
• protocol="org.apache.coyote.http11.Http11NioProtocol": Uses the non-blocking NIO protocol for better performance
• certificateKeystoreFile: Use the absolute path to your keystore file to avoid path issues
• certificateKeystorePassword: The password you set when creating the keystore

Step 4: Test the Configuration #

1. Restart your Tomcat server to apply the changes.
2. Open a browser and navigate to https://your-server-ip:8443 (replace with your server’s IP or domain).
   • If you’re using a self-signed certificate, your browser will show a security warning—this is expected. You can proceed to verify the certificate details.
   • If you’re using a CA-signed certificate, the browser should show a secure lock icon.

Troubleshooting Tips #

• If Tomcat fails to start, check the logs/catalina.out file for errors. Common issues include incorrect file paths, wrong passwords, or missing file permissions (ensure Tomcat has read access to the keystore).
• Make sure your server’s firewall allows incoming traffic on port 8443.

内容的提问来源于stack exchange，提问作者Abdul Salam