0

I am using Red Hat Enterprise Linux Server release 6.7 (Santiago) operating system for accessing my application which is deployed at 8443 port. Please suggest me ways to hit my application like https://localhost/AppName locally and https://HOST_NAME/AppName globally.

Please suggest what changes have to be done in the Linux box. I have done following changes on server.xml file

< Connector 
port="8443" 
protocol="HTTP/1.1" 
SSLEnabled="true"
maxThreads="150" 
scheme="https" 
secure="true"
clientAuth="false" 
sslProtocol="TLS" 
keystoreFile="conf/Certificate/keystore.jks"
keystorePass="<PASSWORD>" 
/>

3 Answers 3

0

You could just change the port tomcat listens on to 443, which is the standard https port.

 < Connector 
port="443" 
protocol="HTTP/1.1" 
SSLEnabled="true"
maxThreads="150" 
scheme="https" 
secure="true"
clientAuth="false" 
sslProtocol="TLS" 
keystoreFile="conf/Certificate/keystore.jks"
keystorePass="<PASSWORD>" 
/>
1
  • Thanks for your suggestion, I think 443 port is a privileged port and the above code is not working.
    – Vaibhav
    Nov 4, 2015 at 18:17
0

You can use nginx as a reverse proxy. Since you already have Tomcat all you have to do is install Nginx and configure SSL and non SSL vhosts. You do this by removing the default vhost file and creating the following in two different files in nginx's config directory:

server {
    listen 80 default_server;

    server_name example.com www.example.com;
    location /{
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;
      proxy_pass              http://localhost:8080
    }
}

and

server{
    listen 443;
    server_name example.com;

    ssl_certificate           /etc/nginx/cert.crt;
    ssl_certificate_key       /etc/nginx/cert.key;

    ssl on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

    location / {
      proxy_set_header        Host $host;
      proxy_set_header        X-Real-IP $remote_addr;
      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header        X-Forwarded-Proto $scheme;
      proxy_pass              http://localhost:8443;
    }
    }

Nginx will proxy all requests to Tomcat now. With Nginx in front you can also leverage its caching abilities. It is great for caching/serving static content.

Don't forget to add your keys to the locations specified in the config above.

-1

https://HOST_NAME:8443/AppName where HOST_NAME is the published DNS name of your server/IP address of your server. AppName would be your path to access(generally your servlet mapping) the application as defined in the web.xml for your application.

5
  • I don't want to use port 8443 I am trying to find a way to work with out port HOST_NAME/AppName
    – Vaibhav
    Nov 4, 2015 at 18:11
  • Oh, then you modify the default connector 8080 to redirect to 8443. For 8080, add redirectPort="8443". Nov 4, 2015 at 18:23
  • Are you running Tomcat as root on your RHEL? Nov 4, 2015 at 18:41
  • No I am not running it as a root.
    – Vaibhav
    Nov 4, 2015 at 18:42
  • 1
    Ports upto 1024 can only be used by the root, you may run Tomcat as root. But if its compromised, your whole server is out in the open. If security is a concern, you may forward the default ports 80 and 443 to 8443. Use something like sudo iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Nov 4, 2015 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.