I am running Tomcat 7 and am deploying a bunch of applications delivered to me by a third party as WAR files.

I'd like to force some of those apps to always use SSL. (All the "SSL" apps are in one service; other apps outside this discussion are in another service.)

I've figured out how to use conf\web.xml to redirect apps from HTTP to HTTPS, but that applies to all applications hosted by Tomcat. I've also figured out how to put web.xml in an unpacked app's web-inf directory; that does the trick for that specific app, but runs the risk of being overwritten if our vendor gives us a new war file to deploy.

I've also tried placing the web.xml file in various places under conf\service\host, or under appbase, but none seem to work.

Is it possible to redirect some apps to SSL without forcing all apps to redirect, or to put the web.xml file inside the extracted WAR file?

Here's my server.xml:

<Service name="secure">
    <Connector port="80" connectionTimeout="20000" redirectPort="443"
        URIEncoding="UTF-8" enableLookups="false" compression="on"
    <Connector port="443"
        URIEncoding="UTF-8" enableLookups="false" compression="on"
        scheme="https" secure="true" SSLEnabled="true" sslProtocol="TLS"
        keystoreFile="..." keystorePass="..." keystoreType="PKCS12" 
        truststoreFile="..." truststorePass="..." truststoreType="JKS"
    <Engine name="secure" defaultHost="localhost">
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm" 
        <Host name="localhost" appBase="webapps" unpackWARs="false" 
            autoDeploy="true" xmlValidation="false" xmlNamespaceAware="false">
<Service name="mutual-secure">

The content of the web.xml files I'm playing with is:

<web-app xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
            <web-resource-name>All applications</web-resource-name>
                <description>Redirect all requests to HTTPS</description>

(For conf\web.xml the security-constraint is added just before the end of the existing file, rather than create a new file.)

My webapps directory (currently) contains only the WAR files.

  • i dont know how but i think its solveable with symblic links :/
    – john Smith
    Jun 24, 2014 at 21:41
  • Good question. But this is more of a server question that is better suited for Server Fault. serverfault.com Aug 23, 2014 at 23:05

1 Answer 1


I'm not aware of additional locations where you can have web.xml files for Tomcat.

One thing that I do is run Tomcat as a secondary server on port 8080 behind Apache. I use mod_proxy to reverse proxy domains from Apache port 80 to Tomcat port 8080. This way I can put all the SSL onto Apache and configure Apache for the non-SSL redirects using virtual hosts. That way the logic for the SSL is configured separately and outside the control of the webapps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.