# How configure let's Encrypt with tomcat **URL:** \ **Category:** Help\ **Created:** [November 11, 2022, 11:38am UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658 "2022-11-11T11:38:09Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 11, 2022, 11:38am UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/1 "2022-11-11T11:38:09Z")
Hi everyone I would like to configure let's encrypt with tomcat. Tomcat is configured in the docker and nginx container on the host; before installing and running certbot, when on the browser I typed [www.example.com](http://www.example.com) the reverse proxy worked correctly giving me the tomcat screen as default page. After launching and executing certbot, the latter sees the directive with the server\_name in the configuration file and gives me ok results by generating the two certificates. The problem is that when I go to the browser again, the message appears: "" "" "" "The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete . This problem can sometimes be caused by disabling or refusing to accept cookies. "" "" "" "" " In my opinion it could be a problem that we need to configure let's encrypt also in the docker tomcat container and also configure the latter to communicate with the outside. At this point a question arises: in this case let's encrypt should I configure it in the tomcat docker container, on nginx or both? I hope for an answer Hello everybody ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [November 11, 2022, 12:33pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/2 "2022-11-11T12:33:23Z")
Hi @Erica95, and welcome to the LE community forum 🙂 You need to review the reverse proxy settings. ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 11, 2022, 5:22pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/3 "2022-11-11T17:22:45Z")
Hello thanks for the intervention. The reverse proxy worked before installing let's encrypt; the problem arose after installing let's encrypt ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 11, 2022, 5:47pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/4 "2022-11-11T17:47:01Z")
You have not explained how you obtained the cert. If you used the --nginx plug-in it will modify your nginx config. If that's the case you should review your nginx reverse proxy settings for that server block. It sounds like there might be a faulty redirect. Maybe a redirect in your https server block that redirects to itself? It is difficult to give advice when you have not answered many of the questions on the form you were shown No, you should not need a cert in tomcat if you are using nginx to proxy. =========================================== Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: I ran this command: It produced this output: My web server is (include version): The operating system my web server runs on is (include version): My hosting provider, if applicable, is: I can login to a root shell on my machine (yes or no, or I don't know): I'm using a control panel to manage my site (no, or provide the name and version of the control panel): The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 12, 2022, 8:07am UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/5 "2022-11-12T08:07:12Z")
I explain in detail what I did in step: 1. I installed nginx and configured the following simple directive (only this one because I wanted to see if everything worked) "" "server { location / { proxy\_pass http: [//x.x.x.x](https://x.x.x.x): 8080; } "" "" So far everything has worked it redirected me to the default tomcat page. 1. I have map ip x.x.x.x to dns name "[example.com](http://example.com)" on aruba and everything worked but we are still in http. 2. I installed certbot and before running it I added the server\_name directive and redirect to the previous block: server { server\_name [example.com](http://example.com); return 301 https: // $ server\_name $ request\_uri; (I also tried https: // $ host $ request\_uri; it always gives me error) location / { proxy\_pass http: [//x.x.x.x](https://x.x.x.x): 8080; } 1. I run sudo certbot --nginx and obviously I am going to modify the block by adding other directives and let's encrypt information. 2. I try from the browser to run the url and it gives me the error: The problem is that when I go to the browser again, the message appears: "" "" "" "The page isn't redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete . This problem can sometimes be caused by disabling or refusing to accept cookies. "" "" "" "" " Now that I've got this wrong for sure, but what I've done are these 5 steps ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 12, 2022, 2:54pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/6 "2022-11-12T14:54:52Z")
> [@Erica95](#): > > server { > server\_name [example.com](http://example.com); > return 301 https: // $ server\_name $ request\_uri; (I also tried https: // $ host $ request\_uri; it always gives me error) > location / { > proxy\_pass http: [//x.x.x.x](https://x.x.x.x): 8080; > > } That is not correct. You should remove the redirect (`return 301 ...`). It can't work until you have a cert and the https server block (port 443) configured. Certbot will setup this https server block for you as you are using the `--nginx` plug-in. You are also missing a listen statement in that server block. This should be in that http server block: ```nohighlight listen 80; ``` ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 19, 2022, 10:05am UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/7 "2022-11-19T10:05:42Z")
Hello sorry for the delay I tried to delete the string and it doesn't work; of course when I deleted the string, I ran the command "sudo certbot --nginx" again and reinstalled the certificate. The procedure does not give me any errors, it tells me that it was successful. I would not have to add something to nginx.conf file at the moment I have this situation in the http block: http { include /etc/nginx/mime.types; include /etc/nginx/sites-enabled/\*; default\_type application/octet-stream; While as a reminder in blocking the .conf file in sites-availables and sites-enabled I have this situation: server { server\_name [example.com](http://example.com); location / { proxy\_pass [http://x.x.x.x:8080](http://x.x.x.x:8080); } The directive listen to 80; it is present in the bottom code block generated by certbot after running it because before running certbot I only had the previous code block; however after running certbot it creates the following blocks for me: server { if ($host = [example.com](http://example.com)) { return 301 https://$host$request\_uri; } #managed by Certbot listen 80; server\_name [example.com](http://example.com); Anyway I also added after the directive "listen 80;" also in the initial server block; however the problem was not solved. One last detail; always before installing certbot, if on the browser I typed the ip address: 80 the redirect for tomcat did it for me. After installing certbot, as already mentioned above, if I type the dns name it gives me time out; Again after installing certbot, if I type [http://ip-address/80](http://ip-address/80) it gives me: "404 Not Found nginx/1.23.2" At this point I wonder if I have to set the proxy again in the block generated by certbot to make the dns work correctly by redirecting me to the tomcat container? I hope for other solutions ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 19, 2022, 2:41pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/8 "2022-11-19T14:41:38Z")
It sounds like you have some problems with the nginx server blocks. If you want help we need more info. Can you please upload the result of this command? ```nohighlight sudo nginx -T >config.txt ``` That is a capital T. Please do not change the domain names in the output. I think some important info is being lost when you try to describe just parts of your config but changing the names. ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 19, 2022, 4:40pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/9 "2022-11-19T16:40:30Z")
nginx: [warn] conflicting server name "[example.com](http://example.com)" on 0.0.0.0:80, ignored nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 19, 2022, 4:46pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/10 "2022-11-19T16:46:48Z")
Yes, as I suspected there is a problem with your nginx config. If you would please upload the `config.txt` file resulting from the command I showed we can help fix that. If you cannot upload that txt file you can copy / paste the contents of that file here. In this case please put 3 _backticks_ before and after the output like this: ``` contents of config.txt ``` ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 19, 2022, 5:14pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/11 "2022-11-19T17:14:22Z")
""" ubuntu@vpn:~$ sudo nginx -T \>config.txt nginx: [warn] conflicting server name "[example.com](http://example.com)" on 0.0.0.0:80, ignored nginx: the configuration file /etc/nginx/nginx.conf syntax is ok nginx: configuration file /etc/nginx/nginx.conf test is successful """ In the meantime, thank you for your availability; however the command sudo nginx -T \>config.txt , sends me the output on the command prompt in clear text and the only lines that appear are these posted above ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [November 19, 2022, 5:15pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/12 "2022-11-19T17:15:40Z")
That's because all the relevant lines are put into `config.txt`. See Mikes instructions above. ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 19, 2022, 5:41pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/13 "2022-11-19T17:41:08Z")
```nohighlight # configuration file /etc/nginx/nginx.conf: user nginx; worker_processes auto; error_log /var/log/nginx/error.log notice; pid /var/run/nginx.pid; events { worker_connections 1024; } http { include /etc/nginx/mime.types; include /etc/nginx/sites-enabled/*; default_type application/octet-stream; log_format main '$remote_addr - $remote_user [$time_local] "$request" ' '$status $body_bytes_sent "$http_referer" ' '"$http_user_agent" "$http_x_forwarded_for"'; access_log /var/log/nginx/access.log main; sendfile on; #tcp_nopush on; keepalive_timeout 65; ``` ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 19, 2022, 6:28pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/14 "2022-11-19T18:28:52Z")
That is not output of the `nginx -T` command. You are only showing parts of your config and those do not show the problem. And, you are using double-quotes instead of a backtick. On my keyboard the backtick is one key to the left of the number 1 key. The below command should create a config.txt file. Please upload it. Or copy/paste the entire contents of that file with 3 backticks before and after. It will be a lot of output and uploading might be easier. ```nohighlight sudo nginx -T >config.txt ``` ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [November 19, 2022, 6:36pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/15 "2022-11-19T18:36:06Z")
@Erica95 during a reply you can use the UP Arrow from computer Icon tool to upload a file. ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/7/e/7eff39a2074d80a0cadaad42f9caaa253e77b4b7.png) ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/7/0/70fc293cfdbcdb5442ee0961c39ce46a17644cbd.png) ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 19, 2022, 6:53pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/16 "2022-11-19T18:53:23Z")
[config.txt](https://community.letsencrypt.org/uploads/short-url/mmYP2v042MOqClDBRG7MlYWZg96.txt) (7.8 KB) ---
**Author:** ![Bruce5051](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/bruce5051/32/76576_2.png) [@Bruce5051](https://community.letsencrypt.org/u/Bruce5051)\ **Post date:** [November 19, 2022, 7:05pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/17 "2022-11-19T19:05:15Z")
Other side note observations: Using [https://crt.sh/](https://crt.sh/) here is a list of issued certificates [crt.sh | fantacalcalciomania.ns0.it](https://crt.sh/?q=fantacalcalciomania.ns0.it), the most recent being **2022-11-17**. ```nohighlight $ nmap 129.152.1.32 Starting Nmap 7.80 ( https://nmap.org ) at 2022-11-19 18:57 UTC Nmap scan report for 129.152.1.32 Host is up (0.17s latency). Not shown: 997 filtered ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 8080/tcp open http-proxy Nmap done: 1 IP address (1 host up) scanned in 11.24 seconds ``` And again using [https://crt.sh/](https://crt.sh/) with **ns0.it** as the input, the list issued certificates [https://crt.sh/?q=ns0.it](https://crt.sh/?q=ns0.it) Kind of looks like **ns0.it** should be on the PUBLIC SUFFIX LIST [View the Public Suffix List](https://publicsuffix.org/list/) ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 19, 2022, 7:36pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/18 "2022-11-19T19:36:51Z")
A minor problem is that you have two identical server blocks. You should remove one of them to avoid the error about "conflicting server name" So, remove _one_ of the below server blocks from `/etc/nginx/sites-enabled/custom_server.conf` file. ```nohighlight server { if ($host = fantacalcalciomania.ns0.it) { return 301 https://$host$request_uri; } # managed by Certbot listen 80; server_name fantacalcalciomania.ns0.it; return 404; # managed by Certbot } ``` Then: - Run `sudo nginx -t` (lower case t) to see if the error went away. - And, run `sudo systemctl reload nginx` to refresh nginx config. _ **The main problem is** _ you do not have port 443 open. As Bruce showed, you have ports 22, 80 and 8080 open but not 443. Port 443 is needed for HTTPS to work. Check your router or other network equipment to configure it like you did for these other ports. Once port 443 is open, requests to your domain should work correctly. Do not use the IP address in your request. Just use your domain name in a browser. Your nginx config will redirect HTTP requests to HTTPS. And, HTTPS requests will proxy to the IP in your proxy statement. However, you should change that IP to your local IP and not use the public IP. Then you can also block requests to port 8080 from the public internet so people cannot use HTTP to access your tomcat directly. ---
**Author:** ![Erica95](https://avatars.discourse-cdn.com/v4/letter/e/71c47a/32.png) [@Erica95](https://community.letsencrypt.org/u/Erica95)\ **Post date:** [November 20, 2022, 9:01am UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/19 "2022-11-20T09:01:37Z")
I had port 443 enabled on the host's linux system but not on the cloud; I thought I had it enabled. Now the link works I'm redirected to the tomcat container in https; What I'm not clear about is why you say there are two blocks and I should delete one of them? The following block: ''' server { if ($host = fantacalciomania.ns0.it) { return 301 https://$host$request\_uri; } #managed by Certbot listen 80; server\_name fantacalcalciomania.ns0.it; return 404; # managed by Certbot } ''' certbot created it for me when I ran it. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 20, 2022, 1:04pm UTC](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658/20 "2022-11-20T13:04:58Z")
> [@Erica95](#): > > What I'm not clear about is why you say there are two blocks and I should delete one of them? > > certbot created it for me when I ran it. I don't know how you got two identical server blocks. Something unusual happened as I have never seen Certbot do that. It does create server blocks for https (port 443) based on your http server block (port 80). And, it can add redirects to your http server block as it did in your case. If you look at the config.txt file you uploaded in post #16 you will see there are two identical server blocks. nginx only allows one server block for each domain name and port (listen value) combination. That is why you get the warning about one of them being ignored. If you remove one of them you won't get the warning anymore. The nginx config will be cleaner. I don't think duplicates will be created again but let us know if it does. [Next page](https://community.letsencrypt.org/t/how-configure-lets-encrypt-with-tomcat/187658.md?page=2)