To ensure information security, user registration and login processes on most websites use encrypted HTTP (i.e., HTTPS) to transmit account credentials. This prevents “man-in-the-middle” attacks from stealing account data. This article briefly outlines the methods and steps for adding an SSL certificate to your website to enable HTTPS. Assuming your website is built directly using Tomcat, you can follow these few steps:

1. Purchase an SSL certificate.
2. Generate a Private Key on your server.
3. Sign your Key with the SSL certificate vendor.
4. Import the signed certificate into the Tomcat KeyStore.
5. Modify the Tomcat configuration and restart the Tomcat service.

Below are the detailed steps for each stage.

1. Purchase an SSL Certificate

The first step to adding HTTPS functionality to your website is to purchase an SSL certificate. Currently, widely used SSL certificate authorities include: VeriSign and Thawte. However, certificates from these authorities can be expensive. If your website only requires encrypted transmission and does not have extremely high security requirements, you may consider purchasing an affordable SSL certificate from GoDaddy.

2. Generate a Private Key

You can easily generate a private key using the OpenSSL tool. However, since we are preparing it for Tomcat, we will use Java’s built-in keytool utility instead.
Navigate to a directory accessible by Tomcat and run:

$ keytool -keysize 2048 -genkey -alias tomcat -keyalg RSA -keystore tomcat.keystore

It will then prompt you to set a password and enter DN (Distinguished Name) information:

Enter keystore password: Set a password to protect your keystore file, e.g., 123456
Re-enter new password: Re-enter the above password
What is your first and last name?
  [Unknown]:  yourdomain.com Enter your website's domain name. Note that a GoDaddy certificate signs only one domain. For example, abc.com and www.abc.com are considered different domains; here you should fill in the specific domain you intend to sign.
What is the name of your organizational unit?
  [Unknown]:  Networking Organizational unit name (arbitrary)
What is the name of your organization?
  [Unknown]:  yourdomain.com Organization name (arbitrary)
What is the name of your City or Locality?
  [Unknown]:  Shenzhen City (arbitrary)
What is the name of your State or Province?
  [Unknown]:  Guangdong Province (arbitrary)
What is the two-letter country code for this unit?
  [Unknown]:  CN Two-letter country code (arbitrary)
Is CN=www.yourdomain.com, OU=Networking, O=yourdomain.com, L=Shenzhen, ST=Guangdong, C=CN correct?
  [no]:  yes If the above information is correct, enter yes

Enter key password for
    (RETURN if same as keystore password): Press Enter directly at this step

After completion, a tomcat.keystore file will be generated in the current directory.

By the way, if your website is used only within your company’s intranet, the current keystore file can actually be used by Tomcat directly; you can skip to Step 5. However, visiting your website via a browser will show a certificate error (because it hasn’t been signed by a trusted certificate vendor).

Back to the main topic: next, generate a Certificate Signing Request (CSR) based on this keystore file:

$ keytool -certreq -keyalg RSA -alias tomcat -file tomcat-yourdomain.csr -keystore tomcat.keystore

Similarly, when asked for a password, enter the one you just set. Upon completion, you will obtain a tomcat-yourdomain.csr file.

3. Sign Your Private Key with the Certificate Vendor

Log in to the SSL certificate vendor where you purchased the certificate (here is GoDaddy). Follow the prompts to enter the CSR input page. Open the previously generated tomcat-yourdomain.csr file with a text editor, copy its content, and paste it into the form on the page. The SSL certificate vendor will send a verification email to the email address associated with the domain registrant based on your domain (so make sure you know what email address was used during domain registration; if it is incorrect, correct it beforehand, otherwise you won’t receive the verification email). This process may take a few minutes or hours. After receiving the verification email, click the link inside to complete the private key signing.

4. Import the Certificate into Tomcat Keystore

Log in to the SSL certificate vendor where you purchased the certificate and download the signed certificate file for your website. On GoDaddy, you will download a zip file containing your website’s certificate file yourdomain.com.crt, as well as GoDaddy’s own certificates (gd_cross_intermediate.crt, gd_intermediate.crt, gd_bundle.crt). All of these need to be imported into Tomcat’s keystore.

GoDaddy’s official tutorial contains some errors. Through experimentation, the correct process is as follows:
a. Download the valicert_class2_root.crt file from here and import it into tomcat.keystore:

$ keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file valicert_class2_root.crt

b. Import gd_cross_intermediate.crt, gd_intermediate.crt, and your website’s certificate yourdomain.com.crt:

$ keytool -import -alias cross -keystore tomcat.keystore -trustcacerts -file gd_cross_intermediate.crt

$ keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gd_intermediate.crt

$ keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file yourdomain.com.crt

5. Modify Tomcat Configuration and Restart Service

Edit Tomcat’s main configuration file server.xml and add an HTTPS Connector below the standard Connector, as follows:

<Connector port="443″ protocol="HTTP/1.1″ SSLEnabled="true"
	 scheme="https" secure="true"
	 clientAuth="false" sslProtocol="TLS"
	 keystoreFile="/PATH/TO/YOUR/FILE/tomcat.keystore"
	 keystorePass="123456″ />

Note that this Connector is only applicable to JIO and NIO types. If your Tomcat uses APR, you should refer to the Apache Httpd certificate signing process (see configuration method here). After restarting Tomcat, visiting https://yourdomain.com should display the effect.

6. Certificate Generation and Signing Methods for Other Web Services

If your website uses web services such as Apache Httpd or nginx, you can refer to GoDaddy’s corresponding official documentation.

How to Purchase Affordable SSL Certificates

There are many online providers of cheap or even free SSL certificates. The most convenient option is likely purchasing Comodo Positive SSL and RapidSSL through namecheap.com. Both cost around $10 per year and can generally be completed within about 10 minutes. Below are the detailed purchase steps:

1. Determine Your Web Server Type

Generally, all web servers other than Java Tomcat (such as Apache Httpd) implement their encryption layer using OpenSSL. Therefore, when purchasing a certificate, first select your web server encryption program as OpenSSL. (Note: Tomcat also uses OpenSSL when combined with APR. If you need to buy an SSL certificate for Tomcat, refer to the older article mentioned in the first paragraph of this text.)

2. Generate Private Key and Certificate Signing Request File

Use the following command to generate a private key and a certificate signing request file:

$ openssl req -nodes -newkey rsa:2048 -keyout my.key -out my-request.csr

The rsa:2048 in this command specifies the encryption algorithm name and key length. The final output includes my.key (the private key, keep it safe) and a certificate signing request file.

When running this command, it will ask for information about your website. For personal websites, most fields can be filled arbitrarily, as long as the “Common Name” field accurately reflects your domain, such as abc.com or xyz.org. Note that you do not need to add the “www” prefix; the SSL certificates sold by namecheap automatically sign your www subdomain in addition, meaning one price covers both abc.com and www.abc.com.

3. Check the Email Address Registered for Your Domain

Certificate vendors verify your domain by sending an email to the contact email address provided during domain registration. If you entered random information when registering your domain, remember to correct it now.

4. Send the Certificate Signing Request File to the Certificate Vendor

Follow the guidance in the purchase process to send the my-request.csr file generated in Step 2 to the certificate vendor. After waiting about ten minutes (sometimes a few hours), the vendor will send you an email. Generally, it contains a verification code. Enter this verification code into the purchase process page to complete domain verification.

5. Obtain the Signed Certificate

After completing the previous step, wait a few more minutes, and you will receive an email (or see it appear in the purchase process) containing your certificate and certificate chain. Specifically, there may be three certificate files:

• yourDomainName.crt
• PositiveSSLCA2.crt
• AddTrustExternalCARoot.crt

Generally, we need to merge the latter two into one file. Open them with Notepad, copy and paste them to form a new file. Note that the content of the *Root.crt file must be placed at the end. For Linux users, you can achieve this with the following command:

$ cat PositiveSSLCA2.crt AddTrustExternalCARoot.crt > yourDomainName.ca-bundle.crt

6. Use the Certificate

Here, taking Apache Httpd as an example, the general settings are as follows:

SSLEngine on
SSLCertificateKeyFile /etc/ssl/ssl.key/my.key
SSLCertificateFile /etc/ssl/ssl.crt/yourDomainName.crt
SSLCertificateChainFile /etc/ssl/ssl.crt/yourDomainName.ca-bundle

If your Apache is configured with multiple virtual hosts, the configuration is as follows:

# make sure add these lines in somewhere else
#NameVirtualHost *:80
#NameVirtualHost *:443

<VirtualHost *:80>
  ServerName www.your-domain.com
  DocumentRoot /var/www/your-domain
  ServerAlias your-domain.com
</VirtualHost>
<VirtualHost *:443>
  SSLEngine on
  SSLCertificateKeyFile /etc/ssl/ssl.key/my.key
  SSLCertificateFile /etc/ssl/ssl.crt/yourDomainName.crt
  SSLCertificateChainFile /etc/ssl/ssl.crt/yourDomainName.ca-bundle
  ServerName www.your-domain.com  
  DocumentRoot /var/www/your-domain
  ServerName your-domain.com
</VirtualHost>

For Tomcat servers using APR, the configuration is as follows:

<Connector port="443" protocol="HTTP/1.1"
address="198.74.59.36"
SSLEnabled="true"
scheme="https" secure="true"
enableLookups="false"
SSLCertificateFile="/etc/ssl/my/yourDomainName.crt"
SSLCertificateChainFile="/etc/ssl/my/yourDomainName.ca-bundle.crt"
SSLCertificateKeyFile="/etc/ssl/my/my.key"/>

The certificate setup is complete.

7. Supplement: SSL Certificate Format Conversion

If you have already purchased an SSL certificate according to the above process but find that it needs to be in Java Keystore format upon use, you will need to convert the OpenSSL certificate:

First, convert the key and certificate to pkcs12 format:

$ openssl pkcs12 -export -in yourDomainName.crt -inkey my.key > my.p12

Then, convert the pkcs12 format to Java keystore format:

$ keytool -importkeystore -srckeystore my.p12 -destkeystore my.jks -srcstoretype pkcs12