How to add SSL to a hosted Tomcat website in the UK

Adding SSL to a hosted Tomcat website is usually a straightforward process once your domain points to the hosting account and the Tomcat application is served through the control panel. In a typical managed hosting setup, the SSL certificate is installed at the web server layer, while Tomcat runs behind Apache or a similar front-end. That means your public site can use HTTPS even when the Java application itself is running inside a private JVM or Tomcat instance managed through Plesk and My App Server.

If your application is already live on a public domain, the goal is to make sure visitors always connect securely, with no certificate warnings and no mixed-content issues. The exact steps depend on whether you are using a certificate issued by your hosting provider, a Let’s Encrypt certificate, or a third-party SSL certificate. In all cases, the key tasks are the same: install the certificate, enable HTTPS for the domain, make sure Tomcat is reachable through the secure virtual host, and redirect HTTP traffic to HTTPS.

What SSL does for a hosted Tomcat site

SSL, more accurately TLS, encrypts traffic between the visitor and your website. For a hosted Tomcat application, this protects login forms, session cookies, API calls, and any user data sent through the browser. It also helps browsers trust the site, which is important for public-facing applications used by customers in the UK market.

In a hosting environment, SSL is typically handled at the web server level rather than inside Tomcat itself. That is normal and often the preferred setup. Apache or the hosting platform terminates HTTPS, then forwards requests to Tomcat locally. This approach keeps certificate management simpler and avoids exposing the application directly on an unsecured port.

Before you start

Check these points first:

• Your domain is already added to the hosting account.
• The Tomcat application is deployed and working over HTTP.
• You have access to the hosting control panel, such as Plesk.
• You know whether you are using the platform’s SSL certificate service or a third-party certificate.
• Your application does not hardcode absolute http:// links in pages, scripts, or API endpoints.

If you are using ITA’s Java hosting through My App Server, the application may be running in a private JVM with Apache Tomcat managed from the control panel. In that case, SSL is usually added to the domain or subscription, not by manually configuring Tomcat connectors unless you have a specific custom setup.

Common SSL setup patterns for hosted Tomcat

There are a few common ways SSL is applied to a hosted Tomcat website:

• SSL on the domain with Tomcat behind Apache - the most common and simplest approach.
• SSL on a reverse proxy - Apache or another front-end terminates HTTPS and passes requests to Tomcat.
• SSL directly in Tomcat - possible in some setups, but less common in managed hosting and usually not needed.

For shared hosting and managed Java hosting, the first option is usually best. It gives you one place to manage certificates and lets the platform route secure traffic to your Tomcat app automatically.

How to add SSL to a hosted Tomcat website in Plesk

If your hosting platform uses Plesk, SSL is generally configured from the domain’s hosting settings. The exact labels may vary, but the workflow is usually similar.

1. Make sure the domain resolves correctly

Before installing SSL, confirm that the domain points to the correct hosting account. The certificate will only validate properly if the hostname resolves to the site you are securing. If DNS is still propagating, wait until the domain is active before requesting or installing the certificate.

2. Open the domain settings in Plesk

Go to the domain that hosts your Tomcat application. Look for SSL/TLS settings, Certificates, or a similar section. On some platforms, SSL can be issued automatically through a built-in Let’s Encrypt option. On others, you may need to upload certificate files manually.

3. Request or install the SSL certificate

You can use one of the following methods:

• Let’s Encrypt - suitable for most public websites and apps.
• Hosting-provided SSL - convenient if included with your service.
• Third-party certificate - useful if you already bought one elsewhere.

If you use Let’s Encrypt, make sure the certificate includes the correct domain name, and any needed aliases such as www. If your site is accessible through both example.co.uk and www.example.co.uk, both names should be covered, or one should redirect to the other.

4. Assign the certificate to the domain

After the certificate is available, select it as the active certificate for the domain. This enables HTTPS for the virtual host. In managed hosting, this is the point where the control panel connects the certificate to the web server front-end that serves your Tomcat application.

5. Enable SSL for the hosting configuration

Some hosting setups have a separate checkbox or option to activate SSL support for the site. Make sure HTTPS is enabled. If your application uses a dedicated proxy or application server mapping, verify that secure traffic is routed to the correct internal service.

6. Set up HTTP to HTTPS redirection

To avoid duplicate content and ensure secure access, redirect all HTTP requests to HTTPS. This is important for SEO and for user trust. A proper redirect also helps browsers remember that the secure version should be used.

In Plesk, redirection may be available from Hosting Settings or Apache & nginx settings. If the platform provides a redirect option, use it rather than writing your own rules unless you need custom behaviour.

7. Test the site in a browser

After activation, open the site with https:// and check for the padlock icon. Test key pages, login areas, forms, and file upload areas if the application has them. Also test the non-secure URL and confirm that it redirects to the HTTPS version.

How SSL works with My App Server and Tomcat

ITA’s My App Server model is designed for practical Java hosting inside a shared hosting account. You can install a private JVM and manage Apache Tomcat through Plesk. In this type of setup, the public website normally sits on the domain’s web server configuration, while Tomcat handles the Java application layer behind it.

That means SSL is usually applied to the public site endpoint, not inside the Java app itself. If the platform is already serving the domain through Apache, the certificate protects the browser connection to Apache. Apache then talks to Tomcat locally over the internal host or configured connector.

This arrangement is useful because it lets you:

• manage SSL from the control panel instead of inside the application;
• use a private JVM for your Java app;
• choose the Java version needed for your deployment;
• deploy WAR, JSP, or servlet applications more easily;
• keep the public site on HTTPS without exposing Tomcat directly.

If you are using a custom Tomcat version or a manually uploaded app server, check how the service is registered in the control panel and whether the domain is mapped through Apache correctly. SSL still belongs to the public domain configuration in most cases.

When to configure SSL inside Tomcat itself

Direct SSL configuration inside Tomcat is sometimes used in standalone server setups, but it is less common in managed hosting. You would usually only consider it if you are running a custom Tomcat instance that listens directly on its own HTTPS port and your hosting platform explicitly supports that model.

In those cases, you would need to:

• generate or install a certificate and private key for Tomcat;
• configure the HTTPS connector in server.xml or the relevant Tomcat configuration;
• open the correct port if the environment allows it;
• restart the Tomcat service;
• test the application directly on the secure Tomcat endpoint.

For most hosted Tomcat websites, this is not the recommended route. If your application is behind Apache and managed through Plesk, SSL at the domain level is simpler and safer to maintain.

Redirect HTTP to HTTPS properly

Once SSL is active, make sure every visitor ends up on the secure version of the site. A proper redirect avoids duplicate content and keeps browser sessions secure.

Recommended redirect behaviour:

• Redirect all http://example.co.uk requests to https://example.co.uk.
• Redirect www and non-www versions consistently.
• Use a single preferred canonical host name.
• Keep redirects simple and permanent where possible.

In many hosting panels, this can be done with a built-in HTTPS redirect option. If you need a manual rule, the exact syntax depends on whether the site uses Apache, nginx, or a combined stack. Keep changes minimal so that the Tomcat application is not affected by unrelated rewrite rules.

Update your Tomcat application after enabling SSL

After the certificate is installed, the browser side of the connection is secure, but your application may still contain old HTTP references. Review the application for these common issues:

• hardcoded http:// links in templates or JSP files;
• image, CSS, or JavaScript references pointing to unsecured URLs;
• API calls to external services using the wrong scheme;
• absolute links in email templates or generated pages;
• cookie settings that should be marked secure when served over HTTPS.

Also check any application logic that builds URLs dynamically. In Java web apps, it is better to use relative URLs or the request context where possible, so the site works correctly in both development and production environments.

Mixed content problems

If a page loads over HTTPS but still requests images, scripts, or styles over HTTP, browsers may block those resources. This is called mixed content. It can break layout, disable functionality, or show warning messages.

To fix it:

• replace http:// references with https:// where the resource supports it;
• use relative URLs for local assets;
• update third-party libraries or CDN links if needed;
• clear browser cache after making changes.

How to verify the SSL installation

After setup, test the following:

• The certificate is issued for the correct domain name.
• The certificate chain is trusted by browsers.
• The site opens at https:// without warnings.
• http:// redirects to https://.
• All key pages and form submissions work correctly.
• No mixed-content warnings appear in the browser console.

For a hosted Tomcat application, it is also worth checking that the Java app itself is responding normally after the redirect. If the application uses sessions or login states, confirm that the secure cookies persist as expected.

Troubleshooting common SSL issues

The browser shows a certificate warning

This usually means the certificate name does not match the domain, the certificate has expired, or the chain is incomplete. Confirm that the certificate covers the exact hostname visitors use.

HTTPS works but the page layout is broken

This often points to mixed content. Review the application’s static resources and replace any unsecured links.

The site does not redirect to HTTPS

Check the redirect settings in the hosting control panel. If the platform uses Apache behind the scenes, make sure any custom rewrite rules are applied in the correct place and do not conflict with Tomcat routing.

Tomcat responds, but the domain does not

This may indicate a mapping issue between the domain and the application server. Verify that the domain is assigned correctly in the control panel and that the site is being served through the expected virtual host.

The SSL certificate does not appear in the control panel

Refresh the service, check the certificate installation status, and confirm that the domain is using the correct subscription or hosting plan. If you uploaded a third-party certificate, make sure the private key and intermediate certificates were imported correctly.

Security best practices for public Tomcat sites

Once SSL is active, keep these habits in place:

• Renew certificates before expiration.
• Use HTTPS for all public entry points.
• Keep Java and Tomcat versions updated where possible.
• Restrict direct access to internal app server ports.
• Use secure cookies for login sessions.
• Review application logs for redirect loops or certificate-related errors.

If your site is a small or medium Java application hosted through My App Server, these steps go a long way toward keeping the deployment reliable without adding unnecessary complexity.

Frequently asked questions

Do I need a separate SSL certificate for Tomcat?

Usually no. In a hosted environment, the certificate is installed on the domain or web server front-end, and Tomcat runs behind it. You only need a Tomcat-level certificate if you are using a direct HTTPS connector in a custom setup.

Can I use Let’s Encrypt with a hosted Tomcat site?

Yes, in most cases. Let’s Encrypt is a common choice for hosted applications because it is automated and works well for public websites. Make sure the domain is pointing correctly before requesting the certificate.

Will SSL affect my Tomcat deployment?

Not in a negative way if it is configured properly. Your application should continue to run normally, but you may need to update links, callback URLs, or cookie settings after switching to HTTPS.

Should I configure HTTPS inside Tomcat or in Plesk?

For managed hosting, it is usually better to configure SSL in Plesk or the hosting control panel. That keeps certificate management simple and matches the way hosted Tomcat services are normally delivered.

Why do I still see HTTP in the browser after enabling SSL?

Your site may still be loading old links, or the redirect has not been configured. Check both the hosting redirect settings and the application code.

Does this work for JSP and servlet applications too?

Yes. The SSL setup applies to the public domain, so JSP, servlet, and WAR-based applications benefit in the same way as a standard Tomcat website.

Summary

To add SSL to a hosted Tomcat website in the UK, install the certificate at the domain or hosting level, enable HTTPS in the control panel, redirect HTTP traffic to HTTPS, and review the application for old unsecured links. In a managed Java hosting setup such as My App Server with Plesk and Apache Tomcat, this is usually the cleanest and most practical approach. It protects your visitors, keeps the deployment easier to maintain, and fits well with small to medium Java applications that need secure public access.