Enabling HTTPs in Tomcat

To enable secure HTTPS connections to the Orchestra monitor via the Tomcat server, you must configure two files: server.xml and web.xml.

1. Edit the server.xml file located in the Tomcat configuration directory conf. The relevant sections shown below should be adjusted.

<Connector port="8080" scheme="HTTP" protocol="HTTP/1.1"
          connectionTimeout="20000"
          redirectPort="9443" />

<Connector port="9443" scheme="HTTPS" protocol="org.apache.coyote.http11.Http11NioProtocol"
          maxThreads="150" SSLEnabled="true">
 <SSLHostConfig>
   <Certificate type="RSA"
                certificateKeystoreFile="webapps/orchestra/WEB-INF/classes/config/security/orchestra.keystore"
                certificateKeystorePassword="ORCHESTRA"
                certificateKeyPassword="ORCHESTRA"/>
 </SSLHostConfig>
</Connector>

Alternatively, you can copy the orchestra.keystore file from webapps/orchestra/WEB-INF/classes/config/security to the Tomcat conf directory. Then, set the attribute certificateKeystoreFile to conf/orchestra.keystore.

2. Modify the web.xml file in the Tomcat configuration directory conf to ensure that all HTTP invocations are redirected to the HTTPS connector. Add the following block:

   <security-constraint>    
         <web-resource-collection>        
           <web-resource-name>orchestra</web-resource-name>
           <url-pattern>/*</url-pattern>        
           <http-method>GET</http-method>        
           <http-method>POST</http-method>    
         </web-resource-collection>    
         <user-data-constraint>        
           <transport-guarantee>CONFIDENTIAL</transport-guarantee>    
         </user-data-constraint>
   </security-constraint>    
   
   <!-- Default page to serve -->
   <welcome-file-list>
      <welcome-file>Orchestra_Web.html</welcome-file>
   </welcome-file-list>