Wsrtjtyk

I've been trying to configure SSL for Tomcat 8.5 server on the school I work to use HTTPS protocol. Since we haven't buy a certificate with a CA, I used certbot to get a free one. I did some configuration and my Tomcat is serving on HTTP but not yet on HTTPS, and there are no errors on the logs. Here is what I did.

-The Tomcat 8.5 is installed on Windows server 2012. It has worked perfectly for 2 years serving applications on regular HTTP.

-Certbot does not support Windows, therefore, I had to install Ubuntu 16.04 on a VM.
-I installed certboot successfully on Ubuntu.
-I used the folowing command to get my certbot certificates:

sudo certbot certonly --preferred-challenges http --manual -d theDomainOfMySchool.com

-After succeeding the ACME challenge, I got these 4 .pem files: cert1.pem, chain1.pem, fullchain1.pem and privkey1.pem.

-All 4 files are clear text in base64 like this extract I’m pasting here:

-----BEGIN CERTIFICATE-----

MIIFYTCCBEmgAwIBAgISAwyxKh7NQWpNnH6w2enPbOlxMA0GCSqGSIb3DQEBCwUA

MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD

-After fighting a while with permissions to copy the 4 files from /etc/letsencrypt/archive, I placed them in the folder of my Tomcat server in Windows.
-I configured Tomcat with the following nodes on server.xml:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

               maxThreads="150" SSLEnabled="true" >

        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />

        <SSLHostConfig>

            <Certificate certificateKeyFile="conf/cert/certbot_gallery/privkey1.pem"

                         certificateFile="conf/cert/certbot_gallery/cert1.pem"

                         certificateChainFile="conf/cert/certbot_gallery/chain1.pem"

                         type="RSA" />

        </SSLHostConfig>

    </Connector>



    <Connector port="80" protocol="HTTP/1.1"

           connectionTimeout="20000"

           redirectPort="8443" />



   <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

-When I start my Tomcat, there are no errors on the logs.

-The server starts fine and serves on HTTP with no problem.

-When I try to access the applications through HTTPS I get ERR_CONNECTION_RESET on the browser.

What am I doing wrong. Are this kind of certificates not suitable for this Tomcat connector? Am I missing any configuration?

Thank you all.

Solved! As it turns out, I'm an as$. The configuration on my server.xml is wrong. The connector for Http11NioProtocol should use the port 443 (which is the default for HTTPS), instead of 8443.
The rest of the configuration and the request of the certs on certboot is OK.

I think the use of 8443 is in case that your Tomcat is behind Apache or something else. Since I'm using directly, and only, Tomcat, the connector port should be 443.
Also, make sure that your firewall allows 443 port.