Installing an SSL certificate on Tomcat

Tomcat 8.5 and later read PEM directly; only older versions need a JKS keystore. The key must be PKCS#8 — convert first if it says BEGIN RSA PRIVATE KEY.

openssl pkcs8 -topk8 -nocrypt -in example.com.key -out conf/example.com.key

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true"
           scheme="https" secure="true">
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
    <SSLHostConfig protocols="TLSv1.2+TLSv1.3">
        <Certificate certificateFile="conf/example.com.crt"
                     certificateChainFile="conf/intermediate.crt"
                     certificateKeyFile="conf/example.com.key"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

Binding to 443 needs root on Linux, which Tomcat should not run as. Either put a reverse proxy in front, or grant the capability: setcap 'cap_net_bind_service=+ep' $(readlink -f $(which java)).

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what Tomcat 9 / 10 actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Installing an SSL certificate on Tomcat

Verify it from the outside

Other platforms