Question

I am getting started now on adding SSL login pages to my webapp. I am using apache mod_proxy to proxy tomcat.

Some tutorials showed that I need to get an SSL certificate for apache and proxy my login pages to tomcat on port 8443.

Is port 8443 automatically an encrypted SSL port for tomcat? Do I need both an apache certificate and a tomcat certificate?

Andy

Answer 1

As far as the browser is concerned, Apache Httpd will “terminate” the SSL/TLS connection to your web server. Whether the content it serves is in fact coming from Tomcat doesn’t matter to the browser. The browser will only see as far as Apache Httpd in that scenario. If it is set up with a certificate recognised by the browser, this is sufficient.

In addition to this, you may want to encrypt the connection between Apache Httpd and Tomcat. This is only really useful if you don’t trust the network between the two (rarely useful on the same host, for example). I don’t think mod_proxy_ajp supports SSL/TLS, but mod_proxy_http does, in which case you need to configure the SSLProxy* directives (see introduction): Apache Httpd will be a client in that respect, and Tomcat will need to be configured with a certificate in this case.

If you don’t need to encrypt the link between Apache Httpd and Tomcat, the easiest is probably to use mod_proxy_http as a reverse proxy to the plain HTTP port of Tomcat (and make sure that port can’t be accessed externally, via a firewall for example).