The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Put Apache HTTP Server or NGINX in front of Tomcat when you want one public HTTPS endpoint, centralized certificate management, and optional load balancing. The proxy terminates TLS on port 443, then forwards to Tomcat over HTTP on a protected network or over a second, certificate-validated HTTPS connection. Tomcat can also terminate TLS itself when the application server must own the certificate or every network hop must be encrypted.
The correct design depends on where certificates live, whether the proxy-to-Tomcat link is trusted, how redirects and cookies are generated, and whether you need WebSockets or multiple Tomcat instances. The procedures below show each design and the settings that keep Tomcat aware that the original client used HTTPS.
Choose where TLS terminates
There are three valid connection paths:
- Proxy termination with an HTTP backend: the client connects to Apache or NGINX over HTTPS; the proxy sends plain HTTP to Tomcat, usually on a private interface or isolated network.
- Proxy termination with an HTTPS backend: the client connects to the proxy over HTTPS and the proxy opens a separately encrypted, certificate-validated connection to Tomcat.
- Direct Tomcat TLS: Tomcat listens with an SSL-enabled connector and may be reached directly or through a proxy that passes the encrypted connection onward.
Terminating public TLS at the proxy is normally the simplest operational choice because one component owns the public certificate, renewal, cipher policy, redirects, and access logging. Encrypt the upstream as well when traffic crosses an untrusted, shared, or physically separate network, or when policy requires encryption on every hop. Direct Tomcat TLS is useful when the application server must control its own certificate or when introducing a reverse proxy would violate the deployment boundary.
| Design | Certificate location | Proxy-to-Tomcat traffic | Operational profile |
|---|---|---|---|
| Apache/NGINX termination | Apache or NGINX | HTTP on a protected network | Fewest moving parts; central renewal and TLS policy |
| Proxy termination plus encrypted upstream | Public certificate at proxy; backend certificate at Tomcat | HTTPS with hostname and expiry validation | Protects every hop; requires a second certificate trust relationship |
| Tomcat termination | Tomcat | HTTPS when a proxy is present, or no proxy | Application server owns TLS; more per-instance configuration |
Apache describes mod_ssl as providing “SSL v3 and TLS v1.x support for the Apache HTTP Server.” The module documentation is at https://httpd.apache.org/docs/current/mod/mod_ssl.html. Protocol and cipher defaults change over time, so verify the versions installed in your environment before hardening a production configuration.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prepare the deployment
Before editing a proxy or Tomcat configuration, establish the public name, listener ports, backend address, and trust boundaries.
- Point the public DNS name at the proxy host. Use the exact name that clients will enter; certificate hostname validation and application-generated absolute URLs depend on it.
- Obtain a certificate and private key covering that public name. Keep the key readable only by the service account or a root-controlled mechanism used to start the service.
- Record Tomcat’s connector address and port, such as
127.0.0.1:8080for a local HTTP connector or a private HTTPS address for an encrypted upstream. - Decide whether the proxy and Tomcat share a host, a private VLAN, or a routed network. Treat HTTP upstream traffic as confidential only when that network is controlled and access-restricted.
- Plan a reload procedure that validates configuration before replacing the running process. Keep a known-good configuration so a failed certificate or proxy change can be rolled back.
Configure Apache as the HTTPS reverse proxy
Load the required Apache modules
Apache needs mod_ssl for the public TLS listener and mod_proxy plus mod_proxy_http to forward HTTP requests. Reverse proxying is enabled by ProxyPass; do not enable forward-proxy mode with ProxyRequests. A forward proxy can expose an unintended open relay, while a reverse proxy accepts requests for your own virtual host and sends them to a defined backend.
Free tools Windows power users keep installed
One-click scans. No signup required.
Module activation is distribution-specific. Use the package manager or the platform’s module tool to ensure these modules are loaded, then run Apache’s configuration test before reloading.
Terminate TLS and forward to an HTTP Tomcat connector
Create an HTTPS virtual host. This example publishes the application at the site root and forwards it to Tomcat on the same machine:
<VirtualHost *:443>
ServerName app.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/app.example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/app.example.com/privkey.pem
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/
RequestHeader set X-Forwarded-Proto "https"
</VirtualHost>Replace the hostname, certificate paths, and connector address with your values. ProxyPassReverse rewrites redirect headers generated by Tomcat so a backend redirect does not expose its private address. The forwarded protocol header gives applications an explicit indication that the client-facing request was HTTPS; configure Tomcat’s proxy metadata as described below so servlet APIs also report secure-request values correctly.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
If Tomcat is mounted below a path rather than at /, keep the trailing slashes consistent, for example ProxyPass /portal/ http://127.0.0.1:8080/portal/ and the matching ProxyPassReverse. Test links and redirects under that prefix because applications sometimes assume they are deployed at the root.
Keep the proxy-to-Tomcat hop encrypted
Use an HTTPS Tomcat connector when the backend network is not fully trusted. Apache’s SSL proxy engine is disabled by default, so enable it inside the TLS virtual host or an applicable server context:
<VirtualHost *:443>
ServerName app.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/app.example.com/fullchain.pem
SSLCertificateKeyFile /etc/ssl/app.example.com/privkey.pem
SSLProxyEngine on
ProxyPass / https://tomcat-internal.example.net:8443/
ProxyPassReverse / https://tomcat-internal.example.net:8443/
</VirtualHost>When Apache connects to an HTTPS backend, keep certificate checks enabled. SSLProxyCheckPeerName defaults to on; if the backend certificate name does not match the host Apache used, Apache rejects the connection and the client receives a 502 response. Expired certificates likewise indicate a failed backend trust check. Install a certificate whose subject or subject-alternative name matches the backend hostname, and ensure Apache trusts the issuing certificate chain. Disabling peer checks should be an exceptional, documented measure for a controlled test environment, not a routine fix.
Validate and reload Apache
- Check that the certificate and key belong together and that the private key is readable by the account that starts Apache.
- Run the platform’s Apache syntax test, such as the packaged
configtestcommand, and correct every error before reloading. - Reload Apache without stopping the listener. Confirm that port 443 presents the intended certificate and that the request reaches Tomcat.
- Inspect Apache’s error log for TLS handshake failures, proxy connection errors, or 502 responses. A 502 generally means Apache could not connect to or validate the backend, not that the public certificate is missing.
Configure NGINX as the HTTPS reverse proxy
One Tomcat instance over HTTP
NGINX uses an upstream group to name backend servers and an HTTPS server block to accept public traffic. For one local Tomcat instance:
upstream tomcat {
server 127.0.0.1:8080;
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/ssl/app.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/app.example.com/privkey.pem;
location / {
proxy_pass http://tomcat;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}proxy_pass http://tomcat sends requests to the upstream group. The forwarded host and protocol preserve the public URL when Tomcat or the application creates redirects, links, or cookie attributes. Keep the path form deliberate: adding a URI to proxy_pass changes how NGINX replaces the matching location prefix.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Run NGINX’s configuration test before reloading. A successful syntax test does not prove that Tomcat is listening, so make a real HTTPS request and inspect both proxy and Tomcat logs.
Use an encrypted NGINX-to-Tomcat connection
Point the upstream at Tomcat’s HTTPS connector and use an HTTPS proxy pass:
upstream tomcat_tls {
server tomcat-internal.example.net:8443;
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/ssl/app.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/app.example.com/privkey.pem;
location / {
proxy_pass https://tomcat_tls;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_ssl_server_name on;
proxy_ssl_name tomcat-internal.example.net;
}
}Configure NGINX’s backend certificate trust and verification settings for your installed version and operating system. The name supplied to the TLS handshake must match the Tomcat certificate, and the issuing chain must be trusted by NGINX. Do not solve a hostname mismatch by turning verification off unless the exception is controlled, temporary, and recorded.
Distribute requests across several Tomcats
Add one server line for each instance in the upstream group:
upstream tomcat_cluster {
server 10.0.10.21:8080;
server 10.0.10.22:8080;
}
server {
listen 443 ssl;
server_name app.example.com;
ssl_certificate /etc/ssl/app.example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/app.example.com/privkey.pem;
location / {
proxy_pass http://tomcat_cluster;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}NGINX can select among the listed backends using its configured balancing policy. Session state, uploads, scheduled jobs, and WebSocket connections must be compatible with that choice. If sessions remain in one Tomcat’s memory, use application-level session replication, a shared session store, or an explicitly appropriate affinity strategy rather than assuming any load-balancing method will preserve a login.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Support WebSockets
WebSocket upgrades need the upgrade headers passed through the proxy. Add them in the location that serves the WebSocket endpoint:
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";Keep ordinary HTTP locations separate if only one application path uses WebSockets. Test idle timeouts and reconnect behavior because a successful TLS handshake does not guarantee that a long-lived upgraded connection will remain open.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Enable TLS directly in Tomcat
Tomcat’s HTTP connector enables TLS with SSLEnabled="true". Set scheme="https" and secure="true" so servlets receive the correct secure-request values. A secure connector must define at least one SSLHostConfig and certificate configuration. NIO and NIO2 connectors can use JSSE or OpenSSL implementations.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443"
SSLEnabled="true"
scheme="https"
secure="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="/etc/tomcat/https-keystore.p12"
certificateKeystorePassword="change-this-password"
type="RSA" />
</SSLHostConfig>
</Connector>Use a protected keystore path and a secret-management method appropriate to your operating system; do not leave a production password in world-readable configuration. The certificate must cover the hostname clients use if they connect directly to Tomcat. When a proxy is the public endpoint, the backend certificate instead needs to match the hostname the proxy uses for validation.
Tell Tomcat about the public URL
When Tomcat is behind Apache or NGINX, set proxyName and proxyPort on the relevant connector when the application needs the public host and port. Tomcat uses these values for request.getServerName() and request.getServerPort(), which applications commonly use to build absolute redirects and URLs. Keep scheme="https" and secure="true" on the connector that represents the externally secure request.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
A mismatch is easy to spot: the browser reaches the site over HTTPS, but the application redirects to an internal hostname, emits an HTTP URL, or marks a session cookie incorrectly. Correct the proxy headers and Tomcat connector metadata together rather than changing only the browser-facing certificate.
Test the complete path
- Check the public certificate: connect to the public hostname, verify the chain, hostname, and expiration date, and confirm that the certificate served is the newly installed one rather than a stale virtual host.
- Check HTTP behavior: request a page through port 443 and inspect the status,
Locationheader, cookie flags, and generated absolute links. A redirect to an internal address indicates missing reverse-proxy rewriting or incorrect Tomcat metadata. - Check the backend independently: from the proxy host, connect to the configured Tomcat address and port. A refused connection means Tomcat is stopped or listening elsewhere; a timeout usually indicates a firewall or routing problem.
- Check encrypted upstream validation: deliberately verify the backend hostname and certificate expiry. A hostname mismatch or expired certificate should fail rather than silently downgrade the connection.
- Check WebSockets if used: open the application’s WebSocket endpoint through the public hostname, observe the upgrade response, and leave the connection open long enough to expose idle-timeout issues.
- Check failover: with multiple Tomcats, stop one instance in a controlled window and confirm that new requests reach a healthy member while existing sessions behave according to the chosen session design.
Troubleshoot common failures
Public clients receive a certificate warning
Confirm that the HTTPS virtual host or NGINX server block matches the requested hostname, the certificate includes that name, and the complete issuing chain is installed. Check file permissions and reload errors. If another service owns port 443, the client may be seeing that service’s certificate instead.
Recommended Free Tools
Apache returns 502 after enabling an HTTPS backend
Verify that SSLProxyEngine on is active, Tomcat is listening on the configured HTTPS port, and the backend name matches its certificate. Apache’s peer-name validation is enabled by default; a mismatch or expired certificate is expected to produce a failed proxy request rather than an insecure connection.
NGINX reports an upstream connection error
Check the upstream address, port, firewall rules, and Tomcat listener binding. For an HTTPS upstream, confirm that the server name used for SNI and certificate validation is the name on the backend certificate. Review NGINX’s error log for handshake details instead of treating every 502 as a public certificate problem.
Redirect loops or HTTP links appear after HTTPS is enabled
Pass the original host and protocol, and configure Tomcat’s proxyName, proxyPort, scheme, and secure values consistently. Remove conflicting application settings that force an HTTP canonical URL. Test both a direct page load and a redirect generated after login.
WebSockets connect and then disconnect
Use HTTP/1.1 to the upstream, pass the Upgrade and Connection headers, and review proxy read and idle timeouts. Ensure that the load-balancing arrangement does not move a stateful connection to an incompatible instance.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchOperate the encrypted connection safely
- Renew the public certificate before expiry and reload the proxy only after its configuration test passes.
- Renew backend Tomcat certificates separately when the proxy-to-Tomcat hop is encrypted; test hostname and chain validation after each renewal.
- Restrict Tomcat’s connector so it is reachable only from the proxy or required private clients. Do not expose an HTTP management or application connector directly to the Internet.
- Log at both layers. Correlate the proxy request with Tomcat’s request log when diagnosing redirects, authentication, or intermittent upstream failures.
- Document which component terminates TLS, which headers establish the original scheme, and where each private key is stored. This prevents a later administrator from disabling validation or changing ports to guess at a fix.
- Recheck TLS defaults and directive names after major Apache, NGINX, or Tomcat upgrades because supported protocols, certificate providers, and default validation behavior can change.
Recommended architecture
For most single-host or private-network deployments, terminate public HTTPS at Apache or NGINX and forward to Tomcat over HTTP on a locked-down local or private interface. This centralizes certificate renewal and keeps the Tomcat configuration focused on the application. Add HTTPS on the upstream when the network crosses hosts, tenants, or any boundary where packet confidentiality cannot be assumed. In that design, retain backend certificate hostname and expiry validation and provision Tomcat with a certificate that the proxy can trust.
Use direct Tomcat TLS when Tomcat must own the certificate, when a proxy is not required, or when policy mandates encrypted traffic from the proxy to every application instance. Whatever design you choose, the deployment is complete only when the public certificate, proxy routing, backend trust, forwarded scheme, Tomcat secure-request metadata, redirects, cookies, and WebSockets all pass tests in the actual environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
