We Keep Coding

How do I get Tomcat to give me the client certificate for authentication in my Application code?

I have a java web application that supplies a REST-API for which I want to implement client certificate authentication. I am using Tomcat 9 Web Server to deploy the application as a warfile.
I only want this validation for the REST API and not for other applications deployed on the same server or other requests (for example the user interface).
Requests without a certificate or without a valid certificate should therefore not be blocked by my Web Server so I can verify the client certificate in my application code.
If I do not configure Tomcat for client certification, I cannot retrieve the certificate within my application code.
I have tried to use the following configuration:
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443"
maxThreads="200"
scheme="https"
secure="true"
SSLEnabled="true"
keyAlias="tthserver" keystoreFile="C:\Temp\keystore\keystore.jks" keystorePass="PW"
truststoreFile="C:\Temp\keystore\truststore.jks" trustStorePass="PW"
clientAuth="want" sslProtocol="TLS" />
This however blocks requests with an invalid client certificate.

You will need to add the CLIENT-CERT login-configuration in the web.xml of the webapplication deployed in tomcat that needs client authentication. Other, web applications need not have this configuration, so when client access resources of other web application, the client authentication will not take place.
For more details you may refer to the link below: -
https://users.tomcat.apache.narkive.com/C1hxh39a/tomcat-and-client-certificates

Tomcat 6 and TLSv1.2 In Java

I have a Java app deployed in tomcat 6. The app sends messages to another service via socket and it needs to use ONLY TLSv1.2 protocol.
In my tomcat6.conf file I put this configuration:
JAVA_HOME=/usr/lib/jvm/jre1.7.0_75
JAVA_OPTS="${JAVA_OPTS} -Djavax.sql.DataSource.Factory=org.apache.commons.dbcp.BasicDataSourceFactory -Dhttps.protocols=TLSv1.2"
But stll use the older tls version.
It there any configuration to apply in java or tomcat to force use TLSv1.2?
Edit 1:
The answer provided by #Peter Walser is good and could work. The problem is I can't modify the code because is a jar provided by third party, and I can only configure the enviroment, not the code.

The https.protocols system property is only considered for HttpsURLConnection and URL.openStream(), as stated in Diagnosing TLS, SSL, and HTTPS
Controls the protocol version used by Java clients which obtain https connections through use of the HttpsURLConnection class or via URL.openStream() operations. ...
For non-HTTP protocols, this can be controlled through the SocketFactory's SSLContext.
You can configure the SSLSocket as follows:
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
socket.setEnabledProtocols(new String[] {"TLSv1.2"});
When working with REST-clients, most of them support configuring the protocols over the SSLContext. Example (JAX-RS client):
Client client = ClientBuilder.newBuilder()
.sslContext(SSLContext.getInstance("TLSv1.2"))
// more settings, such as key/truststore, timeouts, logging
.build();

If you are trying to force the server to use TLSv1.2 the following link may provide what you need.
The Apache Tomcat 5.5 Servlet/JSP Container - SSL Configuration HOW-TO
As the doc specifies edit the Tomcat Configuration File as below,
The implementation of SSL used by Tomcat is chosen automatically unless it is overridden as described below. If the installation uses APR - i.e. you have installed the Tomcat native library - then it will use the APR SSL implementation, otherwise it will use the Java JSSE implementation.
To avoid auto configuration you can define which implementation to use by specifying a classname in the protocol attribute of the Connector.
To define a Java (JSSE) connector, regardless of whether the APR library is loaded or not do:
<Connector protocol="org.apache.coyote.http11.Http11AprProtocol" port="8443" .../>
Configure the Connector in the $CATALINA_BASE/conf/server.xml file, where $CATALINA_BASE represents the base directory for the Tomcat 6 instance. An example <Connector> element for an SSL connector is included in the default server.xml file installed with Tomcat. For JSSE, it should look something like this:
<!--
<Connector
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
SSLCertificateFile="/usr/local/ssl/server.crt"
SSLCertificateKeyFile="/usr/local/ssl/server.pem"
clientAuth="optional" SSLProtocol="TLSv1"/>
-->
You will note that the example SSL connector elements are commented out by default. You can either remove the comment tags from around the the example SSL connector you wish to use or add a new Connector element of your own. In either case, you will need to configure the SSL Connector for your requirements and environment.
The port attribute (default value is 8443) is the TCP/IP port number on which Tomcat will listen for secure connections. You can change this to any port number you wish (such as to the default port for https communications, which is 443). However, special setup (outside the scope of this document) is necessary to run Tomcat on port numbers lower than 1024 on many operating systems.
After completing these configuration changes, you must restart Tomcat as you normally do, and you should be in business. You should be able to access any web application supported by Tomcat via SSL.
Try changing the SSLProtocol attribute in <Connector> element to SSLProtocol="TLSv1.2".
<Connector
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
SSLCertificateFile="/usr/local/ssl/server.crt"
SSLCertificateKeyFile="/usr/local/ssl/server.pem"
clientAuth="optional" SSLProtocol="TLSv1.2"/>

Run java Spring project in port 8443 ( https ) in localhost

I have been trying to run my java spring project in HTTPS mode in my localhost.
The project works perfectly in HTTP but form some features, i need it to run in HTTPS
i have changed the default port to 8443 in the server.xml in tomcat. When i run the spring project, its URL shows https://localhost:8443 instead of localhost:8080 but the page does not load. It says page not found.
Please help me resolve this issue.

You need to set up a Connector that listens on port 8443 and a SSL certificate (keystore file in the example below, set the location as you see fit):
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="${user.home}/keystore" keystorePass="tomcat" keyAlias="tomcat"/>
You can buy a SSL certificate or locally sign it yourself (although you’ll get a browser exception that will ask manual confirmation to accept it). To do the latter you can use Java’s keytool.

Tomcat load balancer creating new sessions only when using SSL

I have a web app hosted on two Tomcat servers, identical WARs and server.xml.
I don't have access to change any of the Apache settings - as such, I know that load balancing works as we have tested by shutting down one server and not the other, etc. Based on Tomcat logs I see both being used.
When using the default Tomcat HTTP port 8080 (in my case that was changed to 8083, nonissue) sessions are retained fine.
However, I made a change to use SSL, port 443 and now sessions are invalidated anywhere from 30 seconds - 5 minutes after creation. I assume this has something to do with session replication as I have not made any changes to the server.xml or web.xml besides pointing to the keystore :
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" secure="true" scheme="https" sslProtocol="TLS"
maxThreads="150"
clientAuth="false" keystoreFile="ssl/keystore.jks" keystorePass="123" />
I'm not exactly sure what else to copy here as the only change to the server.xml has literally be these few lines - I assume the added security is for some reason invalidating the session.
I currently have a test server serving the application on HTTP and HTTPS - even accessing the app at the same time, HTTP goes through fine and retains the session, HTTPS refuses to hold on to the session for longer than 5 minutes.
For what it's worth the SSL cert is installed to both Tomcat servers rather than at the load balancer - according to https://serverfault.com/questions/248139/apache-ssl-losing-session-over-load-balancer that may be the issue? I've only coded the application and changed some of the xml configurations - not sure if this is necessarily an issue I can fix.

Still can not handle HTTPS request in proxy servlet

I have developed a proxy servlet under Tomcat, the servlet receive the request from client and and forward to another proxy server, before forwarding, it will authenticate with the proxy server. Now it can process the HTTP request very well but can not receive the HTTPS request. So this proxy servlet is not perfect.
I have searched google and read many posts in this forum, esp this one:
Developing a proxy servlet that can handle HTTPS connections
I configured the Tomcat to listen on port 8443, as follows:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
keystoreFile="${user.home}/.keystore" keystorePass="changeit"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" redirectPort="8080"/>
I deployed the servlet within eclipse, locally, and I set the browser proxy to 127.0.0.1:8080, but bypass it for localhost.
When I browse https:// localhost:8443/ I can see the https request received in servlet log(by calling request.getScheme() and request.isSecure()). But if i browse https://www.google.com, it can not get connected and my proxy servlet didn't catch the request.
I also override the service() method and print the request.getMethod() and still failed to catch the HTTPS request.
What should I do?
All I want is get the HTTPS request and add the authentication and forward to the next proxy server.
Thanks

That's not the way SSL proxies work. If you set your HTTPS proxy to localhost:8080, then your browser will dutifully connect to localhost:8080 and use the CONNECT verb to tunnel SSL traffic through the HTTP proxy connection. Without doing this, SSL wouldn't be particularly secure and any proxy server administrator could trivially read one's credit card details next time someone decided to buy something from Amazon or check their bank balance or sign up for a recurring-payment adult entertainment web site or whatever it is that people do that requires SSL these days.
It doesn't appear that you've told your browser anything about this new SSL proxy on port 8443, so I'm not sure why you think it would be used. It won't. You may be able to tell your browser to use an SSL-based proxy server - ie, set your proxy ashttps://localhost:8443, but even then it will use CONNECT-based SSL tunneling, so there's really no point except still slower connections.
If all you really need to do is forward this request on to another proxy, you need to forward the CONNECT method to the upstream proxy and include the appropriate authentication information.