SSL Toolkit Logo
Tools Features Compare FAQ Login
Tm

PEM/PFX to Tomcat Config

Convert your SSL certificate to a production-ready Tomcat server.xml configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready Tomcat server.xml Connector configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

Tomcat natively uses PFX/PKCS12 format. The generated config includes SSL/TLS protocol settings, cipher suites, keystore configuration, and HSTS headers. Simply paste your certificate or upload a PFX file, select a security profile, and get a copy-paste ready Tomcat config.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate Tomcat Config and copy or download the Connector configuration.

Use Cases

✓New Tomcat server — Generate SSL config when deploying a new Tomcat server.
✓Certificate renewal — Update Tomcat config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get Tomcat config with HSTS headers ready for preload submission.
✓PFX migration — Convert PFX certificate from IIS/Windows to Tomcat format.
✓Security hardening — Apply Mozilla recommended cipher suites to Tomcat.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •Tomcat prefers PFX/PKCS12 format for keystores. Upload a PFX directly for best results.
  • •Use keystoreType="PKCS12" for modern Tomcat versions.
  • •Restart Tomcat after config changes: ./shutdown.sh && ./startup.sh
  • •Place the keystore in $CATALINA_HOME/conf/ with restrictive permissions.
  • •Set the keystore password in server.xml or use a custom SSLHostConfig.

Tomcat SSL Directives Explained

keystoreFile / keystorePass

Path to the PKCS12 keystore file and its password. Used for the SSL/TLS certificate.

sslProtocol / protocols

Specifies allowed TLS versions. Modern: TLSv1.3. Intermediate: TLSv1.2+TLSv1.3.

ciphers

Comma-separated list of allowed cipher suites for SSL handshake.

SSLHostConfig

Modern Tomcat (8.5+) uses SSLHostConfig elements for fine-grained SSL configuration.

Frequently Asked Questions

What files do I need for Tomcat SSL?

Tomcat typically uses a PKCS12 keystore file. You can upload a PFX file directly, or use this tool to convert PEM files to the required format. The tool generates the server.xml Connector configuration.

How do I create a PKCS12 keystore for Tomcat?

Use keytool: keytool -importkeystore -srckeystore cert.p12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS. Or upload your PFX directly to this tool.

How do I reload Tomcat after changing SSL config?

Run ./shutdown.sh then ./startup.sh to restart Tomcat with the new SSL configuration.

Related Tools

All Servers

Configs for all 6 servers
Ng

PEM to Nginx

Nginx server block config
Ap

PEM to Apache

Apache VirtualHost config

SSL Checker

Verify your Tomcat config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites