How To Force SSL for Tomcat with AWS ELB in Front

Rodrigo Asensio 7 years ago

1 min read

You have an awesome Java app that is growing like crazy and you need to be on top of it

The problem

You have an awesome Java app that is growing like crazy and you need to be on top of it. You will start spawning servers to scale horizontally and putting a reliable balancer in front. AWS ELB is a good one but it will not solve all your needs out of the box. You need to tweak it a little bit to fit your needs.

Your app is secure, you have a SSL certificate installed but the problem is how do I redirect or force all HTTP traffic to HTTPS ?

The approach

Put an NGINX in each Tomcat instance. You will say.. another webserver ? yes, another one. Another point of failure but a very reliable one. Nginx is super reliable and has the smallest footprint I ever seen in a serious web server. (NodeJS is not a serious one, that is why people puts NGINX in front of it)

NGINX Config

NGINX will rewrite all requests to the ELB calling the HTTPS port utilizing status 301.

server {
  listen 80;
  server_name myhost.com;
  # add ssl settings
  return 301 https://myhost.com$request_uri;
}

Tomcat config

Now you need to touch the server.xml configuration of Tomcat (located @ $TOMCAT/conf/server.xml) .

<Connector scheme="https" secure="true" proxyPort="443"
  port="8080" protocol="HTTP/1.1"
  connectionTimeout="25000"
  URIEncoding="UTF-8"
  redirectPort="8443" />

Amazon Elastic Load Balancer

You are not done yet. You have to configure in the AWS ELB the following listeners.

 HTTP 80 -> HTTP 80 (nginx)
 HTTPS 443 -> HTTP 8080 (tomcat)

I hope it works for you. It did for me.

Rodrigo Asensio

Rodrigo Asensio is Manager of Solution Architecture at Amazon Web Services. He has more than 20 years of experience designing and operating distributed solutions. He is currently responsible for a team in the Enterprise segment helping large clients accelerate their adoption of the cloud and optimize the utilization of their resources.