Question

I have a Tomcat app running behind Apache.

Apache is configured for HTTPS while Tomcat still uses HTTP. This means that whenever the user loads a webpage (served by Tomcat via Apache), they see a “mixed content” warning in some browsers.

Also, JSP redirects are not working either.

What’s the best way to resolve this? Should I enable HTTPS for Tomcat?

Answer 1

they see a “mixed content” warning in some browsers

This will only happen when the HTML response of a HTTPS request references other resources like images, CSS and JS files over HTTP instead of HTTPS. You need to fix the resource URLs to be HTTPS as well. Or, if the page can be served over both HTTP and HTTPS, then you need to make the resource URLs scheme-relative, like so:

<link rel="stylesheet" href="//example.com/css/style.css" />
<script src="//example.com/js/script.js"></script>
<img src="//example.com/images/logo.png" />

---

Also, JSP redirects are not working either.

The phrase “not working” is too broad in order to be able to give an answer/solution to that.