{"id":1624,"date":"2012-10-28T10:21:33","date_gmt":"2012-10-28T02:21:33","guid":{"rendered":"http:\/\/rmohan.com\/?p=1624"},"modified":"2012-10-28T11:04:49","modified_gmt":"2012-10-28T03:04:49","slug":"1624","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=1624","title":{"rendered":"Securing Tomcat with Apache Web Server mod_proxy"},"content":{"rendered":"

Securing Tomcat with Apache Web Server mod_proxy<\/h3>\n
\u00a0<\/div>\n

I wanted to enable SSL encryption to allow secure channels (https) to our tomcat server. There were 2 obvious ways to do this:<\/p>\n

    \n
  1. Secure Tomcat directly<\/li>\n
  2. Secure an Apache web server front-end that controls access to tomcat<\/li>\n<\/ol>\n

    Secure Tomcat directly<\/strong><\/p>\n

    Securing tomcat directly is fairly straight-forward and is the easiest. But it does have some drawbacks. The major drawback for me was restricting access to other webapps running within the tomcat container. I had about 5 different webapps running, but I only wanted one to be publicly available. Now some will argue that you can restrict access by enforcing rules within the firewall, but I found that to be clunky. If you’re interested in going this route, here is a link describing how to enable security for tomcat directly:
    http:\/\/tomcat.apache.org\/tomcat-5.5-doc\/ssl-howto.html<\/a><\/p>\n

    Secure an Apache web server front-end<\/strong><\/p>\n

    \u00a0<\/strong>I prefer using Apache web server as the front-end for many reasons which has been discussed to death. I’ll note some of the more important reasons:<\/p>\n