I have a client that is running a database program on a Windows Server 2008 R2 machine. The database is running under Apache Tomcat. They want to give external clients access to the program. It currently works with http://domainname.com/DatabaseProg
under port 80, but we want to secure it with an SSL certificate.
I'm trying to figure out where to install the certificate: under Tomcat or under IIS7. The reason I'm wondering is because of this section in the Tomcat documentation:
"It is important to note that configuring Tomcat to take advantage of secure sockets is usually only necessary when running it as a stand-alone web server. When running Tomcat primarily as a Servlet/JSP container behind another web server, such as Apache or Microsoft IIS, it is usually necessary to configure the primary web server to handle the SSL connections from users. Typically, this server will negotiate all SSL-related functionality, then pass on any requests destined for the Tomcat container only after decrypting those requests."
They have IIS7 installed on the server with the default web site, which is not actively used for anything as far as I know. Is the fact that IIS7 is installed and running mean that I install the SSL certificate there? Or must I install it in the Tomcat folders per their documentation?
Bottom line, I want external clients to be able to access the database securely as: https://domainname.com/DatabaseProg
(presumably through port 443).