Data Encryption with HTTPS using Java Servlets

Question

I'm writing a Java Servlet (javax.servlet.http.HttpServlet) using Tomcat 8 to provide an restful API. I want to configure a Tomcat server to use https and I want all data to be transferred as encrypted.

Despite much searching, I can't find:

How to create an http servlet that can be accessed via https://
Configuring SSL in Tomcat such that there is a secure key exchange; no hassle with certificates, etc.
An answer to what the best security method is. e.g. Is SSL still the way to go?

user207421 · Accepted Answer · 2015-03-18 00:46:50Z

2

Despite much searching, I can't find:

How to create an http servlet that can be accessed via https://

It's the same as writing any other servlet. There is no HTTPS-specific aspect to it.

Configuring SSL in Tomcat such that there is a secure key exchange; no hassle with certificates, etc.

There is no such thing as SSL without certificates, unless you want it completely insecure, in which case there's no point in using SSL at all. The Tomcat documentation has extensive information about generating certificates, keystores, etc.

An answer to what the best security method is. e.g. Is SSL still the way to go?

Yes.

answered Mar 18, 2015 at 0:46

user207421

312k45 gold badges324 silver badges493 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

paiego Over a year ago

I didn't say "without certificate", but with no hassle. The answer is it to create a self-signed certificate via keystore.

user207421 Over a year ago

That's exactly what creates the hassle. The answer is to get it signed by a CA.

paiego Over a year ago

Creating a self-signed certificate was not a hassle for me. I don't need/want it signed by CA.

Ahmed Muaydh · Accepted Answer · 2015-03-18 01:12:45Z

1

There is no such a thing called https servlet. SSL is handled by the servlet container. To enable SSL in tomcat, follow the instructions here to generate a key and have tomcat accepts https - http://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html

2- You can either force https by validating isSecure and redirect to https or use security constraint inside web.xml of your app. Check example here http://docs.oracle.com/cd/E19798-01/821-1841/bncbk/index.html

answered Mar 18, 2015 at 1:12

Ahmed Muaydh

111 bronze badge

Collectives™ on Stack Overflow

Data Encryption with HTTPS using Java Servlets

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related