Using OpenSSL with Apache Tomcat 6

First, install Tomcat Native to enable Apache Portable Runtime (APR) and OpenSSL support in Tomcat 6. On Gentoo, run the following command as root:

emerge -v tomcat-native

To enable APR, edit server.xml and add the following listener inside the <Server> element:

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

Depending on your configuration, this listener may already be present. If so, make sure its SSLEngine attribute is set to on instead of adding a duplicate listener.

Next, add an HTTPS connector inside the appropriate <Service> element in server.xml. This example explicitly selects the APR connector:

<Connector port="8443"
    protocol="org.apache.coyote.http11.Http11AprProtocol"
    maxHttpHeaderSize="8192"
    maxThreads="150"
    minSpareThreads="25"
    enableLookups="false"
    disableUploadTimeout="true"
    acceptCount="100"
    scheme="https"
    secure="true"
    SSLEnabled="true"
    SSLCertificateFile="/path/to/your/certificate.crt"
    SSLCertificateKeyFile="/path/to/your/certificate.key" />

Replace the certificate and private-key paths with the paths to your PEM-encoded files.

If your certificate requires an intermediate certificate chain, add the following attribute to the same <Connector> element, before the closing />:

SSLCertificateChainFile="/path/to/your/intermediate.crt"

Save server.xml and restart Tomcat to apply the changes. For more information, see the Tomcat 6 APR documentation.