title: Tomcat 9 configuration for HTTPS with HSTS
body: <p>We are trying to setup HSTS for an application served from a Tomcat 9 server installed on Windows Server 2016 without IIS. When I load a page from it the response header, in developer console, does include <code>strict-transport-security: max-age=31536000;includeSubDomains;preload</code>. The issue is when the vulnerability scans are run it returns the error message saying <em>&quot;The remote web server is not enforcing HSTS.&quot;</em>.  We are also getting a message saying TLSv1.0 is enabled.</p>
  <p>I should also note the pages served by Tomcat are accessed using the primary domain name which hits a load balancer, that also serves as a reverse proxy, and passes all requests to Tomcat.  We have scanned it using the primary domain assigned to the Load Balancer and by using the Tomcat server name directly without the load balancer and get the same scan results.</p>
  <p>I have included what we are adding to the Tomcat <code>server.xml</code> and <code>web.xml</code> files.  Any suggestions on what we are doing wrong, or are missing, would be greatly appreciated.</p>
  <p>We have included the following in our <code>server.xml</code> file:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;!--  For Redirect from HTTP to HTTPS  --&gt;
  &lt;Connector executor=&quot;tomcatThreadPool&quot;
             port=&quot;80&quot;
             protocol=&quot;HTTP/1.1&quot;
             connectionTimeout=&quot;20000&quot;
             redirectPort=&quot;443&quot;/&gt;
  
  
  &lt;!--  SSL Connector  --&gt;
  &lt;Connector
      port=&quot;443&quot;
      scheme=&quot;https&quot;
      secure=&quot;true&quot;
      SSLEnabled=&quot;true&quot;
      protocol=&quot;org.apache.coyote.http11.Http11Nio2Protocol&quot;
      sslImplementationName=&quot;org.apache.tomcat.util.net.jsse.JSSEImplementation&quot;&gt;
  
      &lt;SSLHostConfig sslProtocol=&quot;TLS&quot;
                     protocols=&quot;TLSv1.2+TLSv1.3&quot;
                     certificateKeystoreFile=&quot;G:\keystore\OUR_KEYSTORE_FILE.jks&quot;
                     certificateKeystorePassword=&quot;OUR_KEYSTORE_PASSWORD&quot;
                     certificateKeystoreType=&quot;JKS&quot;&gt;
      &lt;/SSLHostConfig&gt;
  &lt;/Connector&gt;
  </code></pre>
  <p>We have configured the <code>web.xml</code> file with the following for HSTS and the redirect:</p>
  <pre class="lang-xml prettyprint-override"><code>&lt;!-- Enable HSTS   --&gt;
  &lt;filter&gt;
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;hstsEnabled&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;hstsMaxAgeSeconds&lt;/param-name&gt;
          &lt;param-value&gt;31536000&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;hstsIncludeSubDomains&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;hstsPreload&lt;/param-name&gt;
          &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;antiClickJackingOption&lt;/param-name&gt;
          &lt;param-value&gt;ALLOW-FROM&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;antiClickJackingUri&lt;/param-name&gt;
          &lt;param-value&gt;https://OUR_PRIMARY_DOMAIN.HERE&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;async-supported&gt;true&lt;/async-supported&gt;
  &lt;/filter&gt;
  
  &lt;!-- Enable HSTS Filter  --&gt;
  &lt;filter-mapping&gt;
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;dispatcher&gt;REQUEST&lt;/dispatcher&gt;
  &lt;/filter-mapping&gt;
      
      
  &lt;!--  for Redirect from HTTP to HTTPS  --&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Entire Application&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>