iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To put a Tomcat application on a public domain, point the domain’s DNS record to a public reverse-proxy server, create an Apache HTTP Server virtual host for that hostname, and forward the application context to Tomcat with ProxyPass and ProxyPassReverse. Configure Tomcat’s connector with the public hostname and port so Java code generates links and redirects for the real site instead of an internal address such as localhost:8080.
The arrangement is: app.example.com resolves to Apache, Apache accepts HTTP or HTTPS, and Apache proxies a path such as /myapp to Tomcat on a private listener such as 127.0.0.1:8081. The steps below cover DNS, Apache, Tomcat, TLS, deployment, security, testing, and the failures that usually make a mapped application return a 404 or redirect to the wrong host.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the request travels
A browser never needs to know that the application runs on Tomcat or that Tomcat listens on port 8081. It requests a public URL, for example https://app.example.com/myapp/. DNS returns the address of the reverse-proxy server. Apache selects the virtual host whose ServerName is app.example.com, terminates TLS if HTTPS is used there, and sends the matching path to Tomcat. Tomcat handles the servlet request and returns a response through Apache.
There are three identities to keep consistent:
- Public hostname: the exact name users type, such as
app.example.com. - Proxy route: the URL prefix Apache receives, such as
/myapp. - Tomcat context: the application path Tomcat has deployed, normally also
/myappwhen the WAR is namedmyapp.war.
If one of these differs unintentionally, Apache can send the request to the wrong application, Tomcat can return a 404, or generated URLs can expose the internal connector.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Decide the public URL and context before configuring anything
Use a subdomain and retain the context path
The least surprising first deployment is https://app.example.com/myapp/. The subdomain identifies the service, and the context path identifies the WAR. This makes it easy to host several applications on one Apache server: each hostname can have its own virtual host, or several paths can be mapped deliberately.
Expose the application at the domain root
To make https://app.example.com/ open the application without /myapp, map the root path to the Tomcat context or deploy the application as Tomcat’s root context. Do this only when the public route and the application packaging are intentionally aligned. Root mappings are easier to collide with Apache’s own files and with other virtual-host rules, so test every path after changing them.
Choose the backend listener
Use a Tomcat connector on a private address and port, for example 127.0.0.1:8081 when Apache and Tomcat share a machine. A separate application server can use a private network address instead. The public DNS record should point to Apache’s public address, not directly to the Tomcat port.
Step 1: Create the DNS record
At your domain DNS provider, create the provider-appropriate record for the public hostname. An A record maps app.example.com to an IPv4 address; an AAAA record maps it to IPv6. Some providers offer an equivalent alias record. Use the public address of the reverse-proxy server, and create both address families only when the server and firewall are ready to serve both.
DNS syntax and controls differ by provider, so use that provider’s record editor. Do not add a port number to an A or AAAA record. The record contains a hostname and address; the browser uses the standard HTTP or HTTPS port unless the URL explicitly specifies another port.
Verify the result from a client that uses the same DNS view as your visitors. Confirm that the hostname resolves to the proxy address, not to a private address or an old server. If you have recently changed the record, allow for resolver and record time-to-live caching before treating an old answer as an Apache problem.
Recommended Free Tools
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Step 2: Prepare Tomcat for proxied traffic
Deploy the application at the expected context
A WAR named myapp.war normally creates the /myapp context. Confirm the deployed context in Tomcat’s manager or startup log, and check that the application responds locally before introducing Apache. A context can also be assigned explicitly in Tomcat configuration, so rely on the context Tomcat actually reports rather than the filename alone.
Configure the connector’s public identity
Tomcat sees the proxy as its immediate client. Without additional settings, servlet APIs such as request.getServerName() and request.getServerPort() can report the internal connector instead of the public site. Edit the connector that Apache will use and set proxyName to the public hostname and proxyPort to the port visitors use:
<Connector port="8081" protocol="HTTP/1.1" proxyName="app.example.com" proxyPort="443" />Use proxyPort="443" when Apache is the HTTPS endpoint. Use proxyPort="80" when the public service is HTTP. The Tomcat connector reference describes proxyName and proxyPort specifically for running Tomcat behind a proxy; applications use the resulting server name and port when constructing absolute URLs, redirects, and callback addresses.
The value must match the hostname users request, including the choice between a bare domain and a subdomain. If users can reach the service through more than one public hostname, decide which one is canonical and redirect the others at Apache rather than supplying an arbitrary value to Tomcat.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStep 3: Enable Apache’s proxy modules
Apache HTTP Server needs the general proxy module and the HTTP proxy module. Enable mod_proxy and mod_proxy_http using your operating system’s Apache module mechanism, then reload or restart Apache according to that system’s service procedure. A configuration test should pass before a reload; a syntax error can leave the previous configuration active or prevent Apache from starting.
Do not enable a broad forward-proxy configuration for this task. The virtual host should act as a reverse proxy for defined application destinations, not as an open proxy that accepts arbitrary outbound requests.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Step 4: Create the hostname-based virtual host
Create a virtual host whose ServerName is the exact public hostname. If Apache handles HTTPS, place the TLS certificate and key settings in the SSL virtual host and make sure the certificate covers that name. A minimal HTTP example is:
<VirtualHost *:80>
ServerName app.example.com
ProxyPass /myapp http://127.0.0.1:8081/myapp
ProxyPassReverse /myapp http://127.0.0.1:8081/myapp
</VirtualHost>The first directive sends requests under /myapp to the Tomcat connector. The second rewrites redirect-related response headers so a Tomcat redirect points back through the public proxy route rather than exposing the backend address. Keep the public path and backend path aligned unless you have a deliberate rewrite design.
HTTPS termination at Apache
When Apache is the HTTPS endpoint, use an SSL virtual host on the public HTTPS port with the same ServerName and proxy rules. The browser’s connection is encrypted to Apache; the Apache-to-Tomcat leg can remain HTTP on a protected private network. Set Tomcat’s proxyPort to 443, because that is the port the client sees, not the backend port 8081.
If Apache also accepts HTTP, choose a single canonical policy. A common arrangement is to redirect HTTP requests to the HTTPS hostname before proxying them. Ensure the proxy and application agree that the external request is HTTPS; otherwise an application that believes the request is plain HTTP may emit insecure links or repeatedly redirect to HTTPS.
Step 5: Match the proxy path to the Tomcat context
Apache’s two path arguments are significant:
| Public request | Tomcat context | Proxy target | Result |
|---|---|---|---|
/myapp/login |
/myapp |
http://127.0.0.1:8081/myapp |
Tomcat receives the login request in the myapp application. |
/portal/ |
/portal |
http://127.0.0.1:8081/portal |
The public and backend prefixes remain consistent. |
/ |
Root context | Root-context target | Use only when the application is intentionally deployed as the root application. |
A request for /myapp may be redirected by the application to /myapp/; test both forms. If Apache proxies /portal while the WAR is deployed as /myapp, Tomcat does not automatically know that those names are aliases. Either change the mapping to match the deployed context or configure an explicit, carefully tested rewrite.
Step 6: Configure TLS, certificates, and SNI
The certificate presented to visitors must contain the exact hostname in the URL. With multiple HTTPS virtual hosts on one address, Apache uses Server Name Indication (SNI) to select the certificate and configuration. The requested hostname, the certificate name, and the SSL virtual host must agree.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Tomcat’s SSL guidance notes that hostname-based SSL configurations and strict SNI matching must agree; a mismatch can cause the request to be rejected rather than merely showing a warning. Test the hostname users will actually enter, not only the server’s IP address or an internal name. If TLS is terminated at Apache, certificate validation occurs at Apache; if you also encrypt the backend connection, configure and test that separate trust relationship independently.
Step 7: Protect the Tomcat port
Tomcat’s connector should not be an alternative public entry point. Bind it to the loopback interface when Apache is on the same host, or restrict the listener and firewall to the proxy’s private address when the servers are separate. A public firewall rule for 8081 allows users to bypass TLS, hostname routing, access controls, and logging at Apache.
After changing the binding or firewall, test from both sides: Apache must still reach the connector, while an unrelated external host must not. Keep operating-system and cloud firewall rules consistent; restricting only one layer can leave the port reachable through another network interface.
Step 8: Logging and operational layout
Apache records the client-facing request when it proxies it. Tomcat can still log application and backend details, but duplicate access logs may add noise and storage cost. Decide which layer is authoritative for access reporting and retain the Tomcat logs needed for application troubleshooting, authentication audits, and error diagnosis.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Keep the virtual-host configuration, certificate configuration, Tomcat connector settings, and deployment context under change control. A hostname change is not complete until DNS, Apache’s ServerName, the certificate, Tomcat’s proxyName, application callback settings, and any canonical redirects have all been updated.
Test the mapping in a controlled order
Testing in sequence separates DNS, Apache, Tomcat, and application errors. Record the hostname, public port, proxy path, backend port, and deployed context before starting.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Resolve DNS: confirm that
app.example.comreturns the intended proxy address for every address family you publish. - Check the virtual-host match: send a request with the real hostname and verify that Apache selects the intended virtual host rather than a default site.
- Check the certificate: open the HTTPS URL by hostname and confirm the certificate name and SNI-selected virtual host match it.
- Check a proxied page: request
/myapp/and verify that the response is generated by the expected application, not Apache’s default document or another context. - Check redirects: inspect the
Locationheader for login, trailing-slash, and authentication redirects. It should use the public hostname and public scheme. - Check absolute links: view links, form actions, resource URLs, and callback URLs generated by the application. None should point to
localhost, the internal IP, or port 8081. - Check sessions: log in, follow several application pages, and confirm the session cookie remains associated with the public host and path.
- Check HTTP-to-HTTPS behavior: request the HTTP URL and verify the intended single redirect to the canonical HTTPS URL, without a loop.
- Check direct-backend isolation: from an external network, confirm that the Tomcat port is refused or filtered while the proxied URL works.
Choose between direct Tomcat exposure and a reverse proxy
| Consideration | Direct Tomcat exposure | Apache reverse proxy |
|---|---|---|
| TLS termination | Tomcat handles the public certificate and TLS configuration. | Apache can terminate TLS at the public edge while Tomcat uses a private connector. |
| Backend isolation | The Tomcat listener is directly reachable unless separately protected. | The application port can be limited to the proxy host or private network. |
| Hostname routing | Routing multiple applications or names depends on Tomcat configuration. | Apache virtual hosts route hostnames and paths before forwarding. |
| Static files | Tomcat serves them with the application. | Apache can serve eligible static content separately; deployments that need web-server static handling may consider a connector alternative such as mod_jk. |
| Logging | Tomcat sees the client connection directly. | Apache records the public request and Tomcat records the proxied request, so logging must be designed to avoid unnecessary duplication. |
| Operational complexity | Fewer moving parts for a single internal service, but less edge separation. | Requires DNS, virtual-host, proxy, certificate, and connector coordination. |
Apache’s HTTP proxy is appropriate when you want to forward a selected application without adding a separate web connector. The extra configuration is justified when TLS termination, hostname routing, backend isolation, or a shared web edge matters more than minimizing components.
Troubleshoot the common failures
Redirects contain localhost, an internal address, or port 8080
Tomcat or the application is constructing URLs from the internal connector identity. Set the connector’s proxyName to the public hostname and proxyPort to the public port, then restart or reload Tomcat as required by your deployment. Check that Apache’s ProxyPassReverse is present so backend redirect headers are rewritten. Test a fresh login and any redirect that previously exposed the internal address.
Apache returns 404 or the wrong application appears
Compare the public proxy path with the deployed Tomcat context character for character. Also verify the request’s hostname: if it lands in another virtual host, the correct proxy rule is never evaluated. Confirm that the WAR finished deploying and that a local request to the intended context succeeds before debugging Apache.
The site loops between HTTP and HTTPS
This occurs when Apache terminates TLS but Tomcat or the application believes the original request was HTTP, or when two layers redirect in conflicting ways. Set Tomcat’s public port to 443 for an HTTPS site, keep one canonical redirect policy, and ensure the proxy communicates the external scheme in the way your application expects. Remove duplicate HTTP-to-HTTPS rules while testing so one layer owns the redirect.
Links are insecure even though the browser uses HTTPS
Check the same public-identity settings as for redirect failures and inspect the application’s URL-generation logic. A connector that reports port 8081 or an HTTP scheme can cause absolute resource and callback URLs to be emitted incorrectly. Verify the generated HTML and response headers, not only the address bar.
The certificate is for the wrong hostname or SNI rejects the request
Use the exact hostname in the URL and make sure Apache’s matching SSL virtual host presents a certificate covering it. Review strict SNI settings when multiple names share an address. A certificate for the server’s private name or a different virtual host does not prove that app.example.com is configured correctly.
Free tools Windows power users keep installed
One-click scans. No signup required.
The backend is reachable from the Internet
Inspect the Tomcat connector bind address, host firewall, cloud security group, and any upstream firewall. Restrict port 8081 to loopback or the proxy’s private network, then retest from an external network. Do not rely on an obscure URL path as protection; anyone who can reach the connector can bypass Apache’s hostname and TLS controls.
Quick Recap
Maintenance checklist after the first deployment
- Keep DNS records, certificate names, Apache
ServerName, TomcatproxyName, and application canonical URLs synchronized. - Retest redirects and absolute URLs after changing the public hostname, HTTPS policy, context path, or connector port.
- When deploying a new WAR, verify the resulting context before changing the proxy rule.
- After Apache or Tomcat upgrades, run a configuration test and a complete hostname-based smoke test.
- Monitor both proxy errors and application errors, correlating timestamps so a 502, timeout, or 404 can be located at the correct layer.
- Review firewall rules whenever a server gains a new network interface or moves between hosts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
