Using multiple SSL certificates in single tomcat instance

Question

I know that tomcat can handle multiple SSL certificates by setting up multiple Connectors listening on different IP's, but is it possible to set it up on the same IP?

The situation is that we have multiple web applications running in a single tomcat instance. Our server has only 1 static IP. Tomcat is set up to have Virtual Servers, so depending on the domain it serves a different app. However, if we want SSL in more that one of these apps, I predict we might run into trouble.

Does anyone have more experience in this field?

I believe you can list multiple domains in a single certificate. — Andrew T Finnell, Apr 16 '12 at 11:34
Are you accepting SSL connections or connecting onwards with your own certificates? — Paddy Carroll, Apr 16 '12 at 11:34
@AndrewFinnell - ... not sure what you mean. Are you talking about mutli-domain certificates? Not an option, we need to bill our clients seperately for SSL certificates and cannot regenerate new ones every time we want to add a domain to the list. — Nico Huysamen, Apr 16 '12 at 11:38
@PaddyCarroll - We accept SSL connections. Never use self-signed ones. — Nico Huysamen, Apr 16 '12 at 11:38
@nico Ah you are a service provider. I had not inferred that. — Andrew T Finnell, Apr 16 '12 at 11:40

score 5 · Accepted Answer · answered Apr 16 '12 at 11:44

To be able to use multiple certificates on the same IP address and port, you need Server Name Indication support. Unfortunately, this was introduced in Java 7, only on the client side.

(There are still problems w.r.t. SNI support on the client side, most notably because of lack of support from any version of IE on Win XP, Java 6 and below, and some mobile browsers.)

A workaround for this is to use a single certificate that supports multiple host names. The preferred way to do this is to have a certificate with multiple Subject Alternative Name (SAN) entries. Otherwise, if the names have a pattern, a wildcard certificate may be suitable (e.g. *.example.com for www.example.com and secure.example.com).

Apache Httpd has support for SNI, so you may be able to solve your problem by using distinct VirtualHosts for each host name you want to serve and use a reverse proxy to a different Tomcat configuration for each host.

score 1 · Answer 2 · answered Apr 16 '12 at 12:20

I don't believe you will get away with 1 ip address, but you may use multiple ports

<Connector
       port="9001" maxThreads="200"
       scheme="https" secure="true" SSLEnabled="true"
       keystoreFile="${user.home}/.keystore" keystorePass="changeit"
       clientAuth="false" sslProtocol="TLS"/>
-->

then https:9001//myurl

for your connections I would personally front it off to an apache httpd reverse proxy server though as it gives you way more flexibility and not a little security when properly configured

score 0 · Answer 3 · answered Jan 27 '13 at 07:25

I am not sure, here if "SNI" is really relevant.

But in your case, the typical solution would be so called ssloffloading or ssl Termination: i.e. put your tomcat behinde an apache, which configured to use multiple vhosts / domain names on the same ip. You could configure for each vhost in apache to use its own SSL certificate.

There is a step by step guide for this topic here:

http://milestonenext.blogspot.de/2012/09/ssl-offloading-with-modjk-part-1.html

Using multiple SSL certificates in single tomcat instance

3 Answers3

Linked