# Using OpenSSL with Apache Tomcat 6

*2010-11-26*

> Configure HTTPS in Apache Tomcat 6 using OpenSSL and Tomcat Native, with an APR connector, PEM certificates, and certificate chains.

First, install Tomcat Native to enable Apache Portable Runtime (APR) and OpenSSL support in Tomcat 6. On Gentoo, run the following command as root:

```sh
emerge -v tomcat-native
```

To enable APR, edit `server.xml` and add the following listener inside the `<Server>` element:

```xml
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
```

Depending on your configuration, this listener may already be present. If so, make sure its `SSLEngine` attribute is set to `on` instead of adding a duplicate listener.

Next, add an HTTPS connector inside the appropriate `<Service>` element in `server.xml`. This example explicitly selects the APR connector:

```xml
<Connector port="8443"
    protocol="org.apache.coyote.http11.Http11AprProtocol"
    maxHttpHeaderSize="8192"
    maxThreads="150"
    minSpareThreads="25"
    enableLookups="false"
    disableUploadTimeout="true"
    acceptCount="100"
    scheme="https"
    secure="true"
    SSLEnabled="true"
    SSLCertificateFile="/path/to/your/certificate.crt"
    SSLCertificateKeyFile="/path/to/your/certificate.key" />
```

Replace the certificate and private-key paths with the paths to your PEM-encoded files.

If your certificate requires an intermediate certificate chain, add the following attribute to the same `<Connector>` element, before the closing `/>`:

```xml
SSLCertificateChainFile="/path/to/your/intermediate.crt"
```

Save `server.xml` and restart Tomcat to apply the changes. For more information, see the [Tomcat 6 APR documentation](https://tomcat.apache.org/tomcat-6.0-doc/apr.html).