# Using let's encrypt with tomcat

**URL:** <https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082>\
**Category:** Server\
**Created:** [August 28, 2017, 10:10am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082 "2017-08-28T10:10:46Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\
**Post date:** [August 28, 2017, 12:16pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/2 "2017-08-28T12:16:36Z")

</div>

Tomcat uses either Java keystore files or pfx files. Personally, I find the latter easier to deal with, but if you prefer to use Java keystore files, [there is a guide here](https://community.letsencrypt.org/t/tutorial-java-keystores-jks-with-lets-encrypt/34754).

To generate a PFX file, with certificates already issued by certbot:

```
cd /etc/letsencrypt/live/yourdomain.com
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:apassword

```

You can also do this in a [renew hook](https://certbot.eff.org/docs/using.html#renewing-certificates) too so you don’t have to do it manually every three months.

Then, configure tomcat to use it, e.g.:

```auto
<Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/etc/letsencrypt/live/yourdomain.com/bundle.pfx" keystorePass="apassword"
           clientAuth="false" sslProtocol="TLS" keystoreType="PKCS12"/>

```

If you don’t have a certificate yet and tomcat is listening on port 80, you can obtain one with the http-01 verification method, e.g.

```
sudo certbot certonly --webroot -w /path/to/tomcat/webapps -d yourdomain.com -d www.yourdomain.com

```

EDIT: I updated the tomcat configuration with sahsanu’s advice downthread.

---

_[View the full topic](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082)._