Common steps

1. Prepare

  • Before a HTTPS connection is created and linked to a Java Key Store (JKS), make a backup of the multiserver.conf file.
  • Use CMD to add Keytool to your path (use the real path to keytool) e.g.:

2. Generate an X509 Certificate and Keystore

keytool -genkey -alias noodle.domain.tld -storetype JKS -keysize 2048 -validity 365 -keyalg RSA -keystore noodle.jks

The alias MUST be the domain name (this restriction permits the use of SSL SNI). Wild card alias are supported.
Once this command has been entered, Keytool will ask some questions regarding your company. Enter information as follows:

  • Keystore Password: The first time you run this tool, it will create the keystore file protected by a password. You will need this password every time you access the keystore file.
  • First and Last name: MUST be the domain name, for example .
  • Name of organizational unit: This is not the company name, but may be an internal department, e.g. Marketing Department.
  • Name of your organization: Your company name, e.g. Vialect Inc.
  • City or location, e.g. Windsor
  • State or Province, e.g. Ontario
  • 2-Letter Country code, e.g. CA
  • Certificate password: This can be the same as the password for the keystore file.

3. Get your Certificate signed

Popular Certificate Authorities (CA) include Let's Encrypt, Thawte, VeriSign, GoDaddy, Network Solutions.

  • Make a certificate signing request (CSR):
keytool -certreq -sigalg MD5withRSA -alias noodle.domain.tld -keystore noodle.jks -file noodlecert.csr

Select "Tomcat" as the format when downloading your signed public key from your CA.

  • Import root certificates, if required:
keytool -import -alias carootcert -trustcacerts -file ca-root.crt -keystore noodle.jks
  • Import intermediate certificates, if required:
keytool -import -alias intermediate -trustcacerts -file intermediate.crt -keystore noodle.jks
  • Apply the Certificate Signature:
keytool -import -alias noodle.domain.tld -trustcacerts -file noodlecert.crt -keystore noodle.jks

4. Create a HTTPS Connection

Edit multiserver.conf by adding and adjusting the following example:

Channel.CM_1.channel_0.Enabled = yes
Channel.CM_1.channel_0.Servlet = intranet
Channel.CM_1.channel_0.Url = "/"
Connection.CM_1.Type = https
Connection.CM_1.Port = 443
Connection.CM_1.ThreadTimeout = 1
Connection.CM_1.ClientTimeout = 1
Connection.CM_1.NumThreads = 1000
Connection.CM_1.QueueSize = 1000
Connection.CM_1.KeyManagerProvider = SunJSSE
Connection.CM_1.TrustManager = SUNX509
Connection.CM_1.KeyManagerAlgorithm = SUNX509
Connection.CM_1.KeyStoreProvider = JKS
Connection.CM_1.ClientAuthentication = false
Connection.CM_1.SSLContextProvider = SunJSSE
Connection.CM_1.SecureRandomProvider = SUN
Connection.CM_1.SecureRandomAlgorithm = SHA1PRNG
Connection.CM_1.Password = 123456
Connection.CM_1.KeyStoreLocation = "/opt/Noodle/noodle.jks"

Noodle can now be accessed using the HTTPS protocols.



For those with command line phobia, use one of these tools:


Consider a free certificate (not self signed) as an alternative to not using SSL.

Quick godaddy example

Redirect HTTP to HTTPS

Read how here.

Use Strong Encryption

Read how here.