How to Enable HTTPS (SSL) for Oracle Apex on Apache Tomcat 9 with OpenSSL: A Step-by-Step Guide for Windows

Get rid of the “Not secure” warning for Oracle APEX and ORDS on localhost by building your own Certificate Authority.

If you run Oracle APEX through ORDS on Tomcat, you have probably seen this in Chrome: “Your connection to this site is not secure.” Out of the box, Tomcat serves your application over plain HTTP, for example http://localhost:8081.

In this tutorial I will show you how to switch to HTTPS on port 8443 using only OpenSSL and a few lines in server.xml. We will create our own small Certificate Authority (CA), issue a certificate for localhost, and make Windows trust it, so the browser shows no warnings at all.

What you will build

• A private CA called WR1
• A server certificate for localhost and 127.0.0.1, signed by WR1
• A PKCS12 keystore that Tomcat can load
• A working https://localhost:8443 endpoint

What you need

• Windows with Administrator rights
• Apache Tomcat 9 installed as a Windows service
• Oracle APEX and ORDS running on Tomcat (any web app works)

Heads up: This approach is for local development and testing. For public servers, use a certificate from a public CA such as Let’s Encrypt.

Step 1: Create a working folder

Create one folder to keep all certificate files together. I use C:\app\SSL.

Step 2: Install OpenSSL

Download Win64 OpenSSL Light (I used version 3.6.0) and run the installer. The defaults are fine:

1. Accept the license agreement.
2. Keep the destination C:\Program Files\OpenSSL-Win64.
3. Keep the Start Menu folder name OpenSSL.
4. Under additional tasks, choose The OpenSSL binaries (/bin) directory.
5. Click Install, then Finish.

Add OpenSSL to your PATH

So you can run openssl from any terminal:

1. Open Edit the system environment variables.
2. Click Environment Variables, select Path, then Edit and New.
3. Add this entry and click OK on every window:

C:\Program Files\OpenSSL-Win64\bin

Step 3: Create the OpenSSL configuration file

Open PowerShell as Administrator and go to your folder:

cd C:\app\SSL

Now paste the block below. It creates ssl-Config.cnf, which describes our certificate. The most important part is subjectAltName: modern browsers ignore the Common Name and only trust the names listed in the SAN.

@"
[req]
default_bits       = 2048
prompt             = no
default_md         = sha256
x509_extensions    = v3_req
distinguished_name = dn
req_extensions     = v3_req

[dn]
CN = localhost

[v3_req]
subjectAltName = @alt_names
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[alt_names]
DNS.1 = localhost
IP.1  = 127.0.0.1
"@ | Out-File -FilePath "ssl-Config.cnf" -Encoding ascii

Step 4: Create your own Certificate Authority

A CA is just a private key plus a self-signed certificate. We create a 4096-bit key and a root certificate valid for one year:

openssl genrsa -out WR1.key 4096

openssl req -x509 -new -nodes -key WR1.key -sha256 -days 365 -out WR1.crt -subj "/CN=WR1"

Step 5: Create and sign the localhost certificate

Run these four commands one after another.

Get Abdulrehman’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

5a. Generate the server private key

openssl genrsa -out localhost.key 2048

5b. Create a Certificate Signing Request (CSR) using the config file

openssl req -new -key localhost.key -out localhost.csr -config ssl-config.cnf -extensions v3_req

5c. Sign the CSR with your CA

openssl x509 -req -in localhost.csr -CA WR1.crt -CAkey WR1.key -CAcreateserial -out localhost.crt -days 365 -sha256 -extfile ssl-config.cnf -extensions v3_req

This is one long line. If it works you will see Certificate request self-signature ok and subject=CN=localhost.

5d. Package everything into a PKCS12 file for Tomcat

openssl pkcs12 -export -in localhost.crt -inkey localhost.key -out localhost.p12 -name localhost

OpenSSL asks for an export password twice. Choose one and remember it, because Tomcat needs it in a minute.

Step 6: Make Windows trust your CA

Right now your browser does not know WR1, so it would still show a warning. Let’s fix that.

1. Double-click WR1.crt. Windows says the CA root certificate is not trusted. That is expected.
2. Click Install Certificate…

1. Keep Current User and click Next.
2. Select Place all certificates in the following store, click Browse…, choose Trusted Root Certification Authorities, and click OK.
3. Click Next, then Finish, and confirm the security prompt.

Step 7: Add the HTTPS connector to Tomcat

Open this file in Notepad (run Notepad as Administrator so you can save):

C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\server.xml

Find the commented-out HTTPS example. Add the connector below after the closing -->, so it is not inside the comment:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="C:/app/SSL/localhost.p12"
                     certificateKeystorePassword="your-certificate-password"
                     certificateKeystoreType="PKCS12" />
    </SSLHostConfig>
</Connector>

Three things to double-check:

• Use forward slashes in the file path.
• Replace your-certificate-password with the export password from Step 5d.
• Save the file.

Step 8: Restart Tomcat and test

Open Services (services.msc), select Apache Tomcat 9.0 Tomcat9, and click Restart.

Now open your app over HTTPS on the new port:

https://localhost:8443/ords

The sign-in page loads with no warning. Click the icon next to the address bar and view the certificate. The hierarchy reads WR1 → localhost, which confirms the page is served with your certificate, signed by your CA.

Troubleshooting

openssl is not recognized. The bin folder is missing from Path, or PowerShell was not reopened after you edited Path.

Tomcat will not start. Check the newest log in Tomcat 9.0\logs. The usual suspects are a wrong keystore password, a wrong path, an XML typo, or a connector that is still inside the comment.

Tomcat cannot read the keystore. The service may run as Local Service. Give that account read permission on C:\app\SSL\localhost.p12.

The browser still says “Not secure”. WR1.crt is not in Trusted Root Certification Authorities, or the browser has not been fully restarted. Firefox needs its own import.

ERR_CERT_COMMON_NAME_INVALID. The hostname you typed is not in the SAN list. Add it to [alt_names] and issue the certificate again.

ERR_SSL_PROTOCOL_ERROR. You used http:// on port 8443. HTTPS goes on 8443, HTTP stays on 8081.

Security tips

• Never share or commit WR1.key or localhost.key. Anyone with the CA key can create certificates that your PC trusts.
• Keep the keystore password out of shared documents.
• The certificate expires after 365 days. Repeat the steps before that date.
• Port 8081 still serves plain HTTP unless you disable that connector.

Conclusion

In eight steps you created a private CA, issued a SAN-enabled certificate for localhost, trusted it in Windows, and enabled HTTPS on Tomcat. Your Oracle APEX sign-in page now runs on https://localhost:8443 without any browser warnings.

If this guide helped you, give it a clap and follow for more Oracle APEX and ORDS tutorials. Questions or issues? Leave a comment and I will help.

Tags: Oracle APEX, Apache Tomcat, SSL, HTTPS, OpenSSL, ORDS