Tomcat配置HTTPS后链接不安全，如何获取可用于应用分发的安全HTTPS链接？

Absolutely—you can absolutely get a trusted, secure HTTPS link for your Tomcat application that’s safe to distribute to users. The reason your current setup shows an "unsafe" warning is almost certainly because you’re using a self-signed certificate (the default one generated with keytool and stored in /root/.keystore), which web browsers and devices don’t trust—it hasn’t been validated by a universally recognized Certificate Authority (CA).

Self-signed certificates work for internal testing, but they don’t carry the trust of third-party CAs. When users access your app, their browsers will flag the connection as risky because they can’t verify that your server is actually who it claims to be.

Follow these steps to set up a fully trusted HTTPS connection:

1. Obtain a Valid SSL Certificate from a Trusted CA #

You have two primary options here:

• Free, automated certificates: Use Let’s Encrypt (a widely trusted free CA) via tools like Certbot to get and auto-renew certificates.
• Paid certificates: For enterprise use cases, consider paid CAs like DigiCert or Sectigo, which offer extended validation (EV) certificates for added trust.

To start, generate a Certificate Signing Request (CSR) using keytool (replace placeholders with your details):

# Generate a PKCS12 keystore (modern, recommended format)
keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore keystore.p12 -validity 365

# Generate the CSR file to submit to your CA
keytool -certreq -alias tomcat -file certreq.csr -keystore keystore.p12

Submit the certreq.csr to your chosen CA, and they’ll send you:

• Your domain’s SSL certificate (usually a .crt or .pem file)
• The CA’s intermediate certificate chain (required to establish full trust)

2. Import the CA-Issued Certificates into Your Keystore #

Before updating Tomcat, import the intermediate certificate and your domain certificate into your keystore:

# Import the CA intermediate certificate
keytool -import -alias intermediate -file intermediate.crt -keystore keystore.p12

# Import your domain's signed certificate
keytool -import -alias tomcat -file your-domain.crt -keystore keystore.p12

3. Update Tomcat’s Connector Configuration #

Replace your existing <Connector> block with a more secure, modern configuration. We recommend using the NIO protocol for better performance, and explicitly enabling only secure TLS versions:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true"
           scheme="https" secure="true"
           keystoreFile="/path/to/your/keystore.p12"
           keystorePass="your-keystore-password"
           keystoreType="PKCS12"
           clientAuth="false"
           sslEnabledProtocols="TLSv1.2,TLSv1.3"
           ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256"/>

• keystoreType="PKCS12": Uses the modern, widely supported keystore format (replace JKS).
• sslEnabledProtocols: Disables outdated, insecure protocols like TLSv1.0 and TLSv1.1.
• ciphers: Specifies only strong, secure encryption suites.

4. Verify the Setup #

• Restart Tomcat to apply the changes.
• Access your app via https://your-public-domain:8443 (make sure your domain points to your server’s public IP). You should see a padlock icon in the browser’s address bar with no "unsafe" warnings.
• Use an SSL testing tool to confirm your certificate chain is complete and your configuration meets security best practices.

5. Optional (Recommended for Production): Use a Reverse Proxy #

For production environments, it’s often easier to handle SSL termination with a reverse proxy like Nginx or Apache. This lets Tomcat focus on serving your app, while the proxy manages HTTPS, caching, and load balancing.

Here’s a simplified Nginx configuration example:

server {
    listen 443 ssl;
    server_name your-domain.com;

    ssl_certificate /path/to/your-domain.crt;
    ssl_certificate_key /path/to/your-private-key.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

With this setup, users can access your app via https://your-domain.com (no port required), and Tomcat only needs to listen on port 8080 for HTTP traffic from the proxy.

• Auto-renew certificates: For Let’s Encrypt, use Certbot’s auto-renewal feature to avoid certificate expiration downtime.
• Domain alignment: Ensure your SSL certificate matches the exact domain you’re distributing (e.g., app.your-domain.com instead of just your-domain.com if that’s your app’s URL).
• Avoid self-signed certs for distribution: Reserve self-signed certificates only for internal testing—never share them with external users.

内容的提问来源于stack exchange，提问作者Md. Mostafizur Rahman