Enable SSL in Tomcat for MITS Discover and Report (v12) with an Existing Certificate

The instructions below are for version 12 and newer and assumes you already have a certificate.

If you are running version 12 and newer and need a new certificate, you will want to reference this article.

Enable SSL in Tomcat for MITS Discover and MITS Report (New Certificate Needed)

If you are running version 11, you will want to reference this article.

Enable SSL in Tomcat for MITS Discover and Report (v11) with an Existing Certificate

If you are running a version prior to 11.0, please contact support@whitecupsolutions.comsupport for more information.

The following steps are to enable SSL support in the instance of Tomcat that MITS installs and uses.  This is independent of any other instances of Tomcat that may be running on the server.

This configuration may be lost during an upgrade of MITS.  It's likely you'll need to reapply these changes after each upgrade.

A)  Create PFX using existing SSL cert from IIS.

1. From the web server, click Start
2. In the Search programs and files field, type mmc
3. From the Programs list, click mmc.exe
4. At the permission prompt, click Yes
5. From the Microsoft Management Console (MMC), click  File > Add/Remove Snap-in
6. From the list of snap-ins, select Certificates
7. Click Add
8. Select Computer account
9. Click Next
10. Select Local computer (the computer this console is running on)
11. Click Finish
12. In the Add/Remove Snap-in window, click OK
13. Save these console settings for future use
14. Double click on Certificates (Local Computer) in the center window.
15. Double click on the Personal folder, and then on Certificates.
16. Right Click on the Certificate you would like to backup and choose > All Tasks > Export
17. Follow the Certificate Export Wizard to backup your certificate to a .pfx file.  Use the"Personal Information Exchange - PKCS #12 (.PFX)" format.
18. Choose to 'Yes, export the private key'
19. Choose to "Include all certificates in certificate path if possible." (do NOT select the delete Private Key option)
20. Enter a password you will remember
21. Choose to save file on a set location
22. Click Finish
23. You will receive a message > "The export was successful." > Click OK
24. The .pfx file backup is now saved in the location you selected.

Take note of exported PFX filename and password used.  You will need this information later.

B)  Make a backup of the server.xml file.  It is located here:

[MITS Install Location]/webserver/conf/server.xml

C)  Edit the server.xml file by making the changes highlighted in red below.

<Connector URIEncoding="UTF-8" compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,application/javascr pt,image/svg+xml" compression="on" connectionTimeout="20000" maxPostSize="16777216" port="8080" protocol="HTTP/1.1" address="127.0.0.1" redirectPort="443" useSendfile="false"/>

D) Now uncomment the SSL connector.  Find the following SSL connector in the server.xml file and remove the <!-- and --> from the ends.

Make the changes highlighted in red below.

Be sure to remove type="RSA" at the end.

Depending on your specific version of MITS, the section in green may be slightly different.  This is okay.

<!--
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" URIEncoding="UTF-8" compression="on" maxPostSize="16777216" scheme="https" useSendfile="false" secure="true"                   compressableMimeType="text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,image/svg+xml">

<SSLHostConfig protocols="+TLSv1.2" ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,                                  TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA">

<Certificate certificateKeystoreFile="conf/wildcard.cert.pfx" certificateKeystorePassword="password_goes_here" type="RSA" />

-->

D)  Restart the MITS service to pick up new settings.

E)  Reconfigure any firewall port(s) to allow 443 to this server.