WebSVN - Integrator Subversion - Blame - Rev 771 - /projeto-trade/apache-tomcat-9.0.112/webapps/docs/config/http.html

Rev	Author	Line No.	Line
771	blopes	1	<!DOCTYPE html SYSTEM "about:legacy-compat">
		2	<html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="../images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 Configuration Reference (9.0.112) - The HTTP Connector</title></head><body><div id="wrapper"><header><div id="header"><div><div><div class="logo noPrint"><a href="https://tomcat.apache.org/"><img alt="Tomcat Home" src="../images/tomcat.png"></a></div><div style="height: 1px;"></div><div class="asfLogo noPrint"><a href="https://www.apache.org/" target="_blank"><img src="../images/asf-logo.svg" alt="The Apache Software Foundation" style="width: 266px; height: 83px;"></a></div><h1>Apache Tomcat 9 Configuration Reference</h1><div class="versionInfo">
		3	Version 9.0.112,
		4	<time datetime="2025-11-06">Nov 6 2025</time></div><div style="height: 1px;"></div><div style="clear: left;"></div></div></div></div></header><div id="middle"><div><div id="mainLeft" class="noprint"><div><nav><div><h2>Links</h2><ul><li><a href="../index.html">Docs Home</a></li><li><a href="index.html">Config Ref. Home</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul></div><div><h2>Top Level Elements</h2><ul><li><a href="server.html">Server</a></li><li><a href="service.html">Service</a></li></ul></div><div><h2>Executors</h2><ul><li><a href="executor.html">Executor</a></li></ul></div><div><h2>Connectors</h2><ul><li><a href="http.html">HTTP/1.1</a></li><li><a href="http2.html">HTTP/2</a></li><li><a href="ajp.html">AJP</a></li></ul></div><div><h2>Containers</h2><ul><li><a href="context.html">Context</a></li><li><a href="engine.html">Engine</a></li><li><a href="host.html">Host</a></li><li><a href="cluster.html">Cluster</a></li></ul></div><div><h2>Nested Components</h2><ul><li><a href="cookie-processor.html">CookieProcessor</a></li><li><a href="credentialhandler.html">CredentialHandler</a></li><li><a href="globalresources.html">Global Resources</a></li><li><a href="jar-scanner.html">JarScanner</a></li><li><a href="jar-scan-filter.html">JarScanFilter</a></li><li><a href="listeners.html">Listeners</a></li><li><a href="loader.html">Loader</a></li><li><a href="manager.html">Manager</a></li><li><a href="realm.html">Realm</a></li><li><a href="resources.html">Resources</a></li><li><a href="sessionidgenerator.html">SessionIdGenerator</a></li><li><a href="valve.html">Valve</a></li></ul></div><div><h2>Cluster Elements</h2><ul><li><a href="cluster.html">Cluster</a></li><li><a href="cluster-manager.html">Manager</a></li><li><a href="cluster-channel.html">Channel</a></li><li><a href="cluster-membership.html">Channel/Membership</a></li><li><a href="cluster-sender.html">Channel/Sender</a></li><li><a href="cluster-receiver.html">Channel/Receiver</a></li><li><a href="cluster-interceptor.html">Channel/Interceptor</a></li><li><a href="cluster-valve.html">Valve</a></li><li><a href="cluster-deployer.html">Deployer</a></li><li><a href="cluster-listener.html">ClusterListener</a></li></ul></div><div><h2>web.xml</h2><ul><li><a href="filter.html">Filter</a></li></ul></div><div><h2>Other</h2><ul><li><a href="runtime-attributes.html">Runtime attributes</a></li><li><a href="systemprops.html">System properties</a></li><li><a href="jaspic.html">JASPIC</a></li></ul></div></nav></div></div><div id="mainRight"><div id="content"><h2>The HTTP Connector</h2><h3 id="Table_of_Contents">Table of Contents</h3><div class="text">
		5	<ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Attributes">Attributes</a><ol><li><a href="#Common_Attributes">Common Attributes</a></li><li><a href="#Standard_Implementation">Standard Implementation</a></li><li><a href="#Java_TCP_socket_attributes">Java TCP socket attributes</a></li><li><a href="#NIO_specific_configuration">NIO specific configuration</a></li><li><a href="#NIO2_specific_configuration">NIO2 specific configuration</a></li><li><a href="#APR/native_specific_configuration">APR/native specific configuration</a></li></ol></li><li><a href="#Nested_Components">Nested Components</a></li><li><a href="#Special_Features">Special Features</a><ol><li><a href="#HTTP/1.1_and_HTTP/1.0_Support">HTTP/1.1 and HTTP/1.0 Support</a></li><li><a href="#HTTP/2_Support">HTTP/2 Support</a></li><li><a href="#Proxy_Support">Proxy Support</a></li><li><a href="#Unix_Domain_Socket_Support">Unix Domain Socket Support</a></li><li><a href="#SSL_Support">SSL Support</a></li><li><a href="#SSL_Support_-_SSLHostConfig">SSL Support - SSLHostConfig</a></li><li><a href="#SSL_Support_-_Certificate">SSL Support - Certificate</a></li><li><a href="#SSL_Support_-_Connector_-_NIO_and_NIO2">SSL Support - Connector - NIO and NIO2</a></li><li><a href="#SSL_Support_-_OpenSSL's_SSL_CONF_API">SSL Support - OpenSSL's SSL_CONF API</a></li><li><a href="#Key_store_types">Key store types</a></li><li><a href="#SSL_Support_-_Connector_-_NIO_and_NIO2_(deprecated)">SSL Support - Connector - NIO and NIO2 (deprecated)</a></li><li><a href="#SSL_Support_-_Connector_-_APR/Native_(deprecated)">SSL Support - Connector - APR/Native (deprecated)</a></li><li><a href="#Connector_Comparison">Connector Comparison</a></li></ol></li></ul>
		6	</div><h3 id="Introduction">Introduction</h3><div class="text">
		7
		8	<p>The <strong>HTTP Connector</strong> element represents a
		9	<strong>Connector</strong> component that supports the HTTP/1.1 protocol.
		10	It enables Catalina to function as a stand-alone web server, in addition
		11	to its ability to execute servlets and JSP pages. A particular instance
		12	of this component listens for connections on a specific TCP port number
		13	on the server. One or more such <strong>Connectors</strong> can be
		14	configured as part of a single <a href="service.html">Service</a>, each
		15	forwarding to the associated <a href="engine.html">Engine</a> to perform
		16	request processing and create the response.</p>
		17
		18	<p>If you wish to configure the <strong>Connector</strong> that is used
		19	for connections to web servers using the AJP protocol (such as the
		20	<code>mod_jk 1.2.x</code> connector for Apache 1.3), please refer to the
		21	<a href="ajp.html">AJP Connector</a> documentation.</p>
		22
		23	<p>Each incoming, non-asynchronous request requires a thread for the duration
		24	of that request. If more simultaneous requests are received than can be
		25	handled by the currently available request processing threads, additional
		26	threads will be created up to the configured maximum (the value of the
		27	<code>maxThreads</code> attribute). If still more simultaneous requests are
		28	received, Tomcat will accept new connections until the current number of
		29	connections reaches <code>maxConnections</code>. Connections are queued inside
		30	the server socket created by the <strong>Connector</strong> until a thread
		31	becomes available to process the connection. Once <code>maxConnections</code>
		32	has been reached the operating system will queue further connections. The size
		33	of the operating system provided connection queue may be controlled by the
		34	<code>acceptCount</code> attribute. If the operating system queue fills,
		35	further connection requests may be refused or may time out.</p>
		36
		37	</div><h3 id="Attributes">Attributes</h3><div class="text">
		38
		39	<div class="subsection"><h4 id="Common_Attributes">Common Attributes</h4><div class="text">
		40
		41	<p>All implementations of <strong>Connector</strong>
		42	support the following attributes:</p>
		43
		44	<table class="defaultTable"><tr><th style="width: 15%;">
		45	Attribute
		46	</th><th style="width: 85%;">
		47	Description
		48	</th></tr><tr id="Attributes_Common Attributes_allowTrace"><td><code class="attributeName">allowTrace</code></td><td>
		49	<p>A boolean value which can be used to enable or disable the TRACE
		50	HTTP method. If not specified, this attribute is set to false. As per RFC
		51	7231 section 4.3.8, cookie and authorization headers will be excluded from
		52	the response to the TRACE request. If you wish to include these, you can
		53	implement the <code>doTrace()</code> method for the target Servlet and
		54	gain full control over the response.</p>
		55	</td></tr><tr id="Attributes_Common Attributes_asyncTimeout"><td><code class="attributeName">asyncTimeout</code></td><td>
		56	<p>The default timeout for asynchronous requests in milliseconds. If not
		57	specified, this attribute is set to the Servlet specification default of
		58	30000 (30 seconds).</p>
		59	</td></tr><tr id="Attributes_Common Attributes_discardFacades"><td><code class="attributeName">discardFacades</code></td><td>
		60	<p>A boolean value which can be used to enable or disable the recycling
		61	of the facade objects that isolate the container internal request
		62	processing objects. If set to <code>true</code> the facades will be
		63	set for garbage collection after every request, otherwise they will be
		64	reused. This setting has no effect when the security manager is enabled.
		65	If not specified, this attribute is set to the value of the
		66	<code>org.apache.catalina.connector.RECYCLE_FACADES</code> system
		67	property, or <code>true</code> if not set.</p>
		68	</td></tr><tr id="Attributes_Common Attributes_enableLookups"><td><code class="attributeName">enableLookups</code></td><td>
		69	<p>Set to <code>true</code> if you want calls to
		70	<code>request.getRemoteHost()</code> to perform DNS lookups in
		71	order to return the actual host name of the remote client. Set
		72	to <code>false</code> to skip the DNS lookup and return the IP
		73	address in String form instead (thereby improving performance).
		74	By default, DNS lookups are disabled.</p>
		75	</td></tr><tr id="Attributes_Common Attributes_encodedReverseSolidusHandling"><td><code class="attributeName">encodedReverseSolidusHandling</code></td><td>
		76	<p>When set to <code>reject</code> request paths containing a
		77	<code>%5c</code> sequence will be rejected with a 400 response. When set
		78	to <code>decode</code> request paths containing a <code>%5c</code>
		79	sequence will have that sequence decoded to <code>\</code> at the same
		80	time other <code>%nn</code> sequences are decoded. When set to
		81	<code>passthrough</code> request paths containing a <code>%5c</code>
		82	sequence will be processed with the <code>%5c</code> sequence unchanged.
		83	</p>
		84	<p>When set to <code>decoded</code>, the <strong>allowBackslash</strong>
		85	attribute will be applied after decoding.
		86	</p>
		87	<p>If <code>passthrough</code> is used then it is the application's
		88	responsibility to perform any further <code>%nn</code> decoding required.
		89	Any <code>%25</code> sequences (encoded <code>%</code>) in the request
		90	path with also be processed with the <code>%25</code> sequence unchanged
		91	to avoid potential corruption and/or decoding failure when the path is
		92	subsequently <code>%nn</code> decoded by the application.</p>
		93	<p>If not specified, the default value is <code>decode</code>.</p>
		94	</td></tr><tr id="Attributes_Common Attributes_encodedSolidusHandling"><td><code class="attributeName">encodedSolidusHandling</code></td><td>
		95	<p>When set to <code>reject</code> request paths containing a
		96	<code>%2f</code> sequence will be rejected with a 400 response. When set
		97	to <code>decode</code> request paths containing a <code>%2f</code>
		98	sequence will have that sequence decoded to <code>/</code> at the same
		99	time other <code>%nn</code> sequences are decoded. When set to
		100	<code>passthrough</code> request paths containing a <code>%2f</code>
		101	sequence will be processed with the <code>%2f</code> sequence unchanged.
		102	</p>
		103	<p>If <code>passthrough</code> is used then it is the application's
		104	responsibility to perform any further <code>%nn</code> decoding required.
		105	Any <code>%25</code> sequences (encoded <code>%</code>) in the request
		106	path with also be processed with the <code>%25</code> sequence unchanged
		107	to avoid potential corruption and/or decoding failure when the path is
		108	subsequently <code>%nn</code> decoded by the application.</p>
		109	<p>If not specified the default value is <code>reject</code>. This default
		110	may be modified if the deprecated <a href="systemprops.html">system
		111	property</a>
		112	<code>org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH</code> is
		113	set.</p>
		114	</td></tr><tr id="Attributes_Common Attributes_maxCookieCount"><td><code class="attributeName">maxCookieCount</code></td><td>
		115	<p>The maximum number of cookies that are permitted for a request. A value
		116	of less than zero means no limit. If not specified, a default value of 200
		117	will be used.</p>
		118	</td></tr><tr id="Attributes_Common Attributes_maxParameterCount"><td><code class="attributeName">maxParameterCount</code></td><td>
		119	<p>The maximum total number of request parameters (including uploaded
		120	files) obtained from the query string and, for POST requests, the request
		121	body if the content type is
		122	<code>application/x-www-form-urlencoded</code> or
		123	<code>multipart/form-data</code>. Request parameters beyond this limit
		124	will be ignored. A value of less than 0 means no limit. If not specified,
		125	a default of 10000 is used. The <code>FailedRequestFilter</code>
		126	<a href="filter.html">filter</a> can be used to reject requests that
		127	exceed the limit.</p>
		128	</td></tr><tr id="Attributes_Common Attributes_maxPartCount"><td><code class="attributeName">maxPartCount</code></td><td>
		129	<p>The maximum total number of parts permitted in a request where the
		130	content type is <code>multipart/form-data</code>. This limit is in
		131	addition to <code>maxParameterCount</code>. A value of less than 0 means
		132	no limit. If not specified, a default of 50 is used. Requests that exceed
		133	this limit may be ignored depending on how the application processes the
		134	request. The <code>FailedRequestFilter</code>
		135	<a href="filter.html">filter</a> can be used to always reject requests
		136	that exceed the limit.</p>
		137	<p>The nature of multipart requests and the associated Servlet API
		138	requirements for processing them is such that they can place a significant
		139	demand on memory. Applications utilising multipart requests need to ensure
		140	sufficient memory is available to avoid a potential denial of service. As
		141	a guide, the memory required is <code>maxPartHeaderSize</code> x
		142	<code>maxPartCount</code> x <code>maxConnections</code> x 2 (due to the
		143	implementation). For the defaults that is <code>512 x 50 x 8192 x 2</code>
		144	which is 400MB. If running on Java 8, this is increased by a further
		145	factor of 2 due to the way Java stores Strings internally which increases
		146	the default memory requirements to 800MB.</p>
		147	</td></tr><tr id="Attributes_Common Attributes_maxPartHeaderSize"><td><code class="attributeName">maxPartHeaderSize</code></td><td>
		148	<p>The maximum number of header bytes permitted per part in a request
		149	where the content type is <code>multipart/form-data</code>. Requests that
		150	exceed this limit will be rejected. A value of less than 0 means no limit.
		151	If not specified, a default of 512 is used.</p>
		152	</td></tr><tr id="Attributes_Common Attributes_maxPostSize"><td><code class="attributeName">maxPostSize</code></td><td>
		153	<p>This is the maximum number of request body bytes that will be converted
		154	into request parameters by Tomcat. This limit only applies in specific
		155	circumstances and is <strong>not</strong> a general limit on request body
		156	size for POST requests. The limit only applies when Tomcat is processing
		157	the request body for parameters as per section 3.1.1
		158	(<code>application/x-www-form-urlencoded</code>) or section 3.2
		159	(<code>multipart/form-data</code>) of the Servlet specification. In the
		160	<code>multipart/form-data</code> case, the limit only applies to the data
		161	used to generate the parameters that are made available through the
		162	<code>getParameter()</code> family of methods.</p>
		163	<p>The limit can be disabled by setting this attribute to a value less
		164	than zero. If not specified, this attribute is set to 2097152 (2 MiB).
		165	Note that the
		166	<a href="filter.html#Failed_Request_Filter"><code>FailedRequestFilter</code></a>
		167	can be used to reject requests that exceed this limit.</p>
		168	</td></tr><tr id="Attributes_Common Attributes_maxSavePostSize"><td><code class="attributeName">maxSavePostSize</code></td><td>
		169	<p>The maximum size in bytes of the request body which will be
		170	saved/buffered by the container during FORM or CLIENT-CERT authentication
		171	or during HTTP/1.1 upgrade. For both types of authentication, the request
		172	body will be saved/buffered before the user is authenticated. For
		173	CLIENT-CERT authentication, the request body is buffered for the duration
		174	of the SSL handshake and the buffer emptied when the request is processed.
		175	For FORM authentication the POST is saved whilst the user is re-directed
		176	to the login form and is retained until the user successfully
		177	authenticates or the session associated with the authentication request
		178	expires. For HTTP/1.1 upgrade, the request body is buffered for the
		179	duration of the upgrade process. The limit can be disabled by setting this
		180	attribute to -1. Setting the attribute to zero will disable the saving of
		181	the request body data during authentication and HTTP/1.1 upgrade. If not
		182	specified, this attribute is set to 4096 (4 kilobytes).</p>
		183	</td></tr><tr id="Attributes_Common Attributes_parseBodyMethods"><td><code class="attributeName">parseBodyMethods</code></td><td>
		184	<p>A comma-separated list of HTTP methods for which request
		185	bodies using <code>application/x-www-form-urlencoded</code> will be parsed
		186	for request parameters identically to POST. This is useful in RESTful
		187	applications that want to support POST-style semantics for PUT requests.
		188	Note that any setting other than <code>POST</code> causes Tomcat
		189	to behave in a way that goes against the intent of the servlet
		190	specification.
		191	The HTTP method TRACE is specifically forbidden here in accordance
		192	with the HTTP specification.
		193	The default is <code>POST</code></p>
		194	</td></tr><tr id="Attributes_Common Attributes_port"><td><strong><code class="attributeName">port</code></strong></td><td>
		195	<p>The TCP port number on which this <strong>Connector</strong>
		196	will create a server socket and await incoming connections. Your
		197	operating system will allow only one server application to listen
		198	to a particular port number on a particular IP address. If the special
		199	value of 0 (zero) is used, then Tomcat will select a free port at random
		200	to use for this connector. This is typically only useful in embedded and
		201	testing applications.</p>
		202	</td></tr><tr id="Attributes_Common Attributes_protocol"><td><code class="attributeName">protocol</code></td><td>
		203	<p>Sets the protocol to handle incoming traffic. The default value is
		204	<code>HTTP/1.1</code> which uses an auto-switching mechanism to select
		205	either a Java NIO based connector or an APR/native based connector.
		206	If the <code>PATH</code> (Windows) or <code>LD_LIBRARY_PATH</code> (on
		207	most unix systems) environment variables contain the Tomcat native
		208	library, and the <code>AprLifecycleListener</code> that is used to
		209	initialize APR has its <code>useAprConnector</code> attribute set to
		210	<code>true</code>, the APR/native connector will be used. If the native library
		211	cannot be found or the attribute is not configured, the Java NIO based
		212	connector will be used. Note that the APR/native connector has different
		213	settings for HTTPS than the Java connectors.<br>
		214	To use an explicit protocol rather than rely on the auto-switching
		215	mechanism described above, the following values may be used:<br>
		216	<code>org.apache.coyote.http11.Http11NioProtocol</code> -
		217	non blocking Java NIO connector<br>
		218	<code>org.apache.coyote.http11.Http11Nio2Protocol</code> -
		219	non blocking Java NIO2 connector<br>
		220	<code>org.apache.coyote.http11.Http11AprProtocol</code> -
		221	the APR/native connector.<br>
		222	Custom implementations may also be used.<br>
		223	Take a look at our <a href="#Connector_Comparison">Connector
		224	Comparison</a> chart. The configuration for both Java connectors is
		225	identical, for http and https.<br>
		226	For more information on the APR connector and APR specific SSL settings
		227	please visit the <a href="../apr.html">APR documentation</a>
		228	</p>
		229	</td></tr><tr id="Attributes_Common Attributes_proxyName"><td><code class="attributeName">proxyName</code></td><td>
		230	<p>If this <strong>Connector</strong> is being used in a proxy
		231	configuration, configure this attribute to specify the server name
		232	to be returned for calls to <code>request.getServerName()</code>.
		233	See <a href="#Proxy_Support">Proxy Support</a> for more
		234	information.</p>
		235	</td></tr><tr id="Attributes_Common Attributes_proxyPort"><td><code class="attributeName">proxyPort</code></td><td>
		236	<p>If this <strong>Connector</strong> is being used in a proxy
		237	configuration, configure this attribute to specify the server port
		238	to be returned for calls to <code>request.getServerPort()</code>.
		239	See <a href="#Proxy_Support">Proxy Support</a> for more
		240	information.</p>
		241	</td></tr><tr id="Attributes_Common Attributes_redirectPort"><td><code class="attributeName">redirectPort</code></td><td>
		242	<p>If this <strong>Connector</strong> is supporting non-SSL
		243	requests, and a request is received for which a matching
		244	<code><security-constraint></code> requires SSL transport,
		245	Catalina will automatically redirect the request to the port
		246	number specified here.</p>
		247	</td></tr><tr id="Attributes_Common Attributes_scheme"><td><code class="attributeName">scheme</code></td><td>
		248	<p>Set this attribute to the name of the protocol you wish to have
		249	returned by calls to <code>request.getScheme()</code>. For
		250	example, you would set this attribute to "<code>https</code>"
		251	for an SSL Connector. The default value is "<code>http</code>".
		252	</p>
		253	</td></tr><tr id="Attributes_Common Attributes_secure"><td><code class="attributeName">secure</code></td><td>
		254	<p>Set this attribute to <code>true</code> if you wish to have
		255	calls to <code>request.isSecure()</code> to return <code>true</code>
		256	for requests received by this Connector. You would want this on an
		257	SSL Connector or a non SSL connector that is receiving data from a
		258	SSL accelerator, like a crypto card, an SSL appliance or even a webserver.
		259	The default value is <code>false</code>.</p>
		260	</td></tr><tr id="Attributes_Common Attributes_URIEncoding"><td><code class="attributeName">URIEncoding</code></td><td>
		261	<p>This specifies the character encoding used to decode the URI bytes,
		262	after %xx decoding the URL. The default value is <code>UTF-8</code>.</p>
		263	</td></tr><tr id="Attributes_Common Attributes_useBodyEncodingForURI"><td><code class="attributeName">useBodyEncodingForURI</code></td><td>
		264	<p>This specifies if the encoding specified in contentType should be used
		265	for URI query parameters, instead of using the URIEncoding. This
		266	setting is present for compatibility with Tomcat 4.1.x, where the
		267	encoding specified in the contentType, or explicitly set using
		268	Request.setCharacterEncoding method was also used for the parameters from
		269	the URL. The default value is <code>false</code>.
		270	</p>
		271	<p><strong>Notes:</strong> 1) This setting is applied only to the
		272	query string of a request. Unlike <code>URIEncoding</code> it does not
		273	affect the path portion of a request URI. 2) If request character
		274	encoding is not known (is not provided by a browser and is not set by
		275	<code>SetCharacterEncodingFilter</code> or a similar filter using
		276	Request.setCharacterEncoding method), the default encoding is always
		277	"ISO-8859-1". The <code>URIEncoding</code> setting has no effect on
		278	this default.
		279	</p>
		280	</td></tr><tr id="Attributes_Common Attributes_useIPVHosts"><td><code class="attributeName">useIPVHosts</code></td><td>
		281	<p>Set this attribute to <code>true</code> to cause Tomcat to use
		282	the IP address that the request was received on to determine the Host
		283	to send the request to. The default value is <code>false</code>.</p>
		284	</td></tr><tr id="Attributes_Common Attributes_xpoweredBy"><td><code class="attributeName">xpoweredBy</code></td><td>
		285	<p>Set this attribute to <code>true</code> to cause Tomcat to advertise
		286	support for the Servlet specification using the header recommended in the
		287	specification. The default value is <code>false</code>.</p>
		288	</td></tr></table>
		289
		290	</div></div>
		291
		292	<div class="subsection"><h4 id="Standard_Implementation">Standard Implementation</h4><div class="text">
		293
		294	<p>The standard HTTP connectors (NIO, NIO2 and APR/native) all support the
		295	following attributes in addition to the common Connector attributes listed
		296	above.</p>
		297
		298	<table class="defaultTable"><tr><th style="width: 15%;">
		299	Attribute
		300	</th><th style="width: 85%;">
		301	Description
		302	</th></tr><tr id="Attributes_Standard Implementation_acceptCount"><td><code class="attributeName">acceptCount</code></td><td>
		303	<p>The maximum length of the operating system provided queue for incoming
		304	connection requests when <code>maxConnections</code> has been reached. The
		305	operating system may ignore this setting and use a different size for the
		306	queue. When this queue is full, the operating system may actively refuse
		307	additional connections or those connections may time out. The default
		308	value is 100.</p>
		309	</td></tr><tr id="Attributes_Standard Implementation_acceptorThreadPriority"><td><code class="attributeName">acceptorThreadPriority</code></td><td>
		310	<p>The priority of the acceptor thread. The thread used to accept
		311	new connections. The default value is <code>5</code> (the value of the
		312	<code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
		313	for the <code>java.lang.Thread</code> class for more details on what
		314	this priority means.</p>
		315	</td></tr><tr id="Attributes_Standard Implementation_address"><td><code class="attributeName">address</code></td><td>
		316	<p>For servers with more than one IP address, this attribute specifies
		317	which address will be used for listening on the specified port. By
		318	default, the connector will listen all local addresses. Unless the JVM is
		319	configured otherwise using system properties, the Java based connectors
		320	(NIO, NIO2) will listen on both IPv4 and IPv6 addresses when configured
		321	with either <code>0.0.0.0</code> or <code>::</code>. The APR/native
		322	connector will only listen on IPv4 addresses if configured with
		323	<code>0.0.0.0</code> and will listen on IPv6 addresses (and optionally
		324	IPv4 addresses depending on the setting of <strong>ipv6v6only</strong>) if
		325	configured with <code>::</code>.</p>
		326	</td></tr><tr id="Attributes_Standard Implementation_allowHostHeaderMismatch"><td><code class="attributeName">allowHostHeaderMismatch</code></td><td>
		327	<p>By default Tomcat will reject requests that specify a host in the
		328	request line but specify a different host in the host header. This
		329	check can be disabled by setting this attribute to <code>true</code>. If
		330	not specified, the default is <code>false</code>.
		331	<br>
		332	This setting will be removed in Tomcat 11 onwards where it will be
		333	hard-coded to <code>false</code>.</p>
		334	</td></tr><tr id="Attributes_Standard Implementation_allowedTrailerHeaders"><td><code class="attributeName">allowedTrailerHeaders</code></td><td>
		335	<p>By default Tomcat will ignore all trailer headers when processing
		336	chunked input. For a header to be processed, it must be added to this
		337	comma-separated list of header names.</p>
		338	</td></tr><tr id="Attributes_Standard Implementation_bindOnInit"><td><code class="attributeName">bindOnInit</code></td><td>
		339	<p>Controls when the socket used by the connector is bound. If set to
		340	<code>true</code> it is bound when the connector is initiated and unbound
		341	when the connector is destroyed. If set to <code>false</code>, the socket
		342	will be bound when the connector is started and unbound when it is
		343	stopped. If not specified, the default is <code>true</code>.</p>
		344	</td></tr><tr id="Attributes_Standard Implementation_clientCertProvider"><td><code class="attributeName">clientCertProvider</code></td><td>
		345	<p>When client certificate information is presented in a form other than
		346	instances of <code>java.security.cert.X509Certificate</code> it needs to
		347	be converted before it can be used and this property controls which JSSE
		348	provider is used to perform the conversion. For example it is used with
		349	the <a href="ajp.html">AJP connectors</a>, the HTTP APR connector and
		350	with the <a href="valve.html#SSL_Authenticator_Valve">
		351	org.apache.catalina.valves.SSLValve</a>. If not specified, the default
		352	provider will be used.</p>
		353	</td></tr><tr id="Attributes_Standard Implementation_compressibleMimeType"><td><code class="attributeName">compressibleMimeType</code></td><td>
		354	<p>The value is a comma separated list of MIME types for which HTTP
		355	compression may be used.
		356	The default value is
		357	<code>
		358	text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml
		359	</code>.
		360	If you specify a type explicitly, the default is over-ridden.</p>
		361	</td></tr><tr id="Attributes_Standard Implementation_compression"><td><code class="attributeName">compression</code></td><td>
		362	<p>The <strong>Connector</strong> may use HTTP/1.1 GZIP compression in
		363	an attempt to save server bandwidth. The acceptable values for the
		364	parameter is "off" (disable compression), "on" (allow compression, which
		365	causes text data to be compressed), "force" (forces compression in all
		366	cases), or a numerical integer value (which is equivalent to "on", but
		367	specifies the minimum amount of data before the output is compressed). If
		368	the content-length is not known and compression is set to "on" or more
		369	aggressive, the output will also be compressed. If not specified, this
		370	attribute is set to "off".</p>
		371	<p><em>Note</em>: There is a tradeoff between using compression (saving
		372	your bandwidth) and using the sendfile feature (saving your CPU cycles).
		373	If the connector supports the sendfile feature, e.g. the NIO connector,
		374	using sendfile will take precedence over compression. The symptoms will
		375	be that static files greater that 48 KiB will be sent uncompressed.
		376	You can turn off sendfile by setting <code>useSendfile</code> attribute
		377	of the connector, as documented below, or change the sendfile usage
		378	threshold in the configuration of the
		379	<a href="../default-servlet.html">DefaultServlet</a> in the default
		380	<code>conf/web.xml</code> or in the <code>web.xml</code> of your web
		381	application.
		382	</p>
		383	</td></tr><tr id="Attributes_Standard Implementation_compressionMinSize"><td><code class="attributeName">compressionMinSize</code></td><td>
		384	<p>If <strong>compression</strong> is set to "on" then this attribute
		385	may be used to specify the minimum amount of data before the output is
		386	compressed. If not specified, this attribute is defaults to "2048".
		387	Units are in bytes.</p>
		388	</td></tr><tr id="Attributes_Standard Implementation_connectionLinger"><td><code class="attributeName">connectionLinger</code></td><td>
		389	<p>The number of seconds during which the sockets used by this
		390	<strong>Connector</strong> will linger when they are closed. The default
		391	value is <code>-1</code> which disables socket linger.</p>
		392	</td></tr><tr id="Attributes_Standard Implementation_connectionTimeout"><td><code class="attributeName">connectionTimeout</code></td><td>
		393	<p>The number of milliseconds this <strong>Connector</strong> will wait,
		394	after accepting a connection, for the request URI line to be
		395	presented. Use a value of -1 to indicate no (i.e. infinite) timeout.
		396	The default value is 60000 (i.e. 60 seconds) but note that the standard
		397	server.xml that ships with Tomcat sets this to 20000 (i.e. 20 seconds).
		398	Unless <strong>disableUploadTimeout</strong> is set to <code>false</code>,
		399	this timeout will also be used when reading the request body (if any).</p>
		400	</td></tr><tr id="Attributes_Standard Implementation_connectionUploadTimeout"><td><code class="attributeName">connectionUploadTimeout</code></td><td>
		401	<p>Specifies the timeout, in milliseconds, to use while a data upload is
		402	in progress. If not specified the default
		403	value is 300000 (i.e. 300 seconds). This only takes effect if
		404	<strong>disableUploadTimeout</strong> is set to <code>false</code>.
		405	</p>
		406	</td></tr><tr id="Attributes_Standard Implementation_continueResponseTiming"><td><code class="attributeName">continueResponseTiming</code></td><td>
		407	<p>When to respond with a <code>100</code> intermediate response code to a
		408	request containing an <code>Expect: 100-continue</code> header.
		409	The following values may used:
		410	<ul>
		411	<li><code>immediately</code> - an intermediate 100 status response
		412	will be returned as soon as practical</li>
		413	<li><code>onRead</code> - an intermediate 100 status
		414	response will be returned only when the Servlet reads the request body,
		415	allowing the servlet to inspect the headers and possibly respond
		416	before the user agent sends a possibly large request body.</li>
		417	</ul>
		418	</p>
		419	</td></tr><tr id="Attributes_Standard Implementation_defaultSSLHostConfigName"><td><code class="attributeName">defaultSSLHostConfigName</code></td><td>
		420	<p>The name of the default <strong>SSLHostConfig</strong> that will be
		421	used for secure connections (if this connector is configured for secure
		422	connections) if the client connection does not provide SNI or if the SNI
		423	is provided but does not match any configured
		424	<strong>SSLHostConfig</strong>. If not specified the default value of
		425	<code>_default_</code> will be used. Provided values are always converted
		426	to lower case.</p>
		427	</td></tr><tr id="Attributes_Standard Implementation_disableUploadTimeout"><td><code class="attributeName">disableUploadTimeout</code></td><td>
		428	<p>This flag allows the servlet container to use a different, usually
		429	longer connection timeout during data upload. If not specified, this
		430	attribute is set to <code>true</code> which disables this longer timeout.
		431	</p>
		432	</td></tr><tr id="Attributes_Standard Implementation_executor"><td><code class="attributeName">executor</code></td><td>
		433	<p>A reference to the name in an <a href="executor.html">Executor</a>
		434	element. If this attribute is set, and the named executor exists, the
		435	connector will use the executor, and all the other thread attributes will
		436	be ignored. Note that if a shared executor is not specified for a
		437	connector then the connector will use a private, internal executor to
		438	provide the thread pool.</p>
		439	</td></tr><tr id="Attributes_Standard Implementation_executorTerminationTimeoutMillis"><td><code class="attributeName">executorTerminationTimeoutMillis</code></td><td>
		440	<p>The time that the private internal executor will wait for request
		441	processing threads to terminate before continuing with the process of
		442	stopping the connector. If not set, the default is <code>5000</code> (5
		443	seconds).</p>
		444	</td></tr><tr id="Attributes_Standard Implementation_keepAliveTimeout"><td><code class="attributeName">keepAliveTimeout</code></td><td>
		445	<p>The number of milliseconds this <strong>Connector</strong> will wait
		446	for another HTTP request before closing the connection. The default value
		447	is to use the value that has been set for the
		448	<strong>connectionTimeout</strong> attribute.
		449	Use a value of -1 to indicate no (i.e. infinite) timeout.</p>
		450	</td></tr><tr id="Attributes_Standard Implementation_maxConnections"><td><code class="attributeName">maxConnections</code></td><td>
		451	<p>The maximum number of connections that the server will accept and
		452	process at any given time. When this number has been reached, the server
		453	will accept, but not process, one further connection. This additional
		454	connection be blocked until the number of connections being processed
		455	falls below <strong>maxConnections</strong> at which point the server will
		456	start accepting and processing new connections again. Note that once the
		457	limit has been reached, the operating system may still accept connections
		458	based on the <code>acceptCount</code> setting. The default value
		459	is <code>8192</code>.</p>
		460	<p>For NIO/NIO2 only, setting the value to -1, will disable the
		461	maxConnections feature and connections will not be counted.</p>
		462	</td></tr><tr id="Attributes_Standard Implementation_maxExtensionSize"><td><code class="attributeName">maxExtensionSize</code></td><td>
		463	<p>Limits the total length of chunk extensions in chunked HTTP requests.
		464	If the value is <code>-1</code>, no limit will be imposed. If not
		465	specified, the default value of <code>8192</code> will be used.</p>
		466	</td></tr><tr id="Attributes_Standard Implementation_maxHeaderCount"><td><code class="attributeName">maxHeaderCount</code></td><td>
		467	<p>The maximum number of headers in a request that are allowed by the
		468	container. A request that contains more headers than the specified limit
		469	will be rejected. A value of less than 0 means no limit.
		470	If not specified, a default of 100 is used.</p>
		471	</td></tr><tr id="Attributes_Standard Implementation_maxHttpHeaderSize"><td><code class="attributeName">maxHttpHeaderSize</code></td><td>
		472	<p>Provides the default value for
		473	<strong>maxHttpRequestHeaderSize</strong> and
		474	<strong>maxHttpResponseHeaderSize</strong>. If not specified, this
		475	attribute is set to 8192 (8 KiB).</p>
		476	</td></tr><tr id="Attributes_Standard Implementation_maxHttpRequestHeaderSize"><td><code class="attributeName">maxHttpRequestHeaderSize</code></td><td>
		477	<p>The maximum permitted size of the request line and headers associated
		478	with an HTTP request, specified in bytes. This is compared to the number
		479	of bytes received so includes line terminators and whitespace as well as
		480	the request line, header names and header values. If not specified, this
		481	attribute is set to the value of the <code>maxHttpHeaderSize</code>
		482	attribute.</p>
		483	<p>If you see "Request header is too large" errors you can increase this,
		484	but be aware that Tomcat will allocate the full amount you specify for
		485	every request. For example, if you specify a maxHttpRequestHeaderSize of
		486	1 MB and your application handles 100 concurrent requests, you will see
		487	100 MB of heap consumed by request headers.</p>
		488	</td></tr><tr id="Attributes_Standard Implementation_maxHttpResponseHeaderSize"><td><code class="attributeName">maxHttpResponseHeaderSize</code></td><td>
		489	<p>The maximum permitted size of the response line and headers associated
		490	with an HTTP response, specified in bytes. This is compared to the number
		491	of bytes written so includes line terminators and whitespace as well as
		492	the status line, header names and header values. If not specified, this
		493	attribute is set to the value of the <code>maxHttpHeaderSize</code>
		494	attribute.</p>
		495	</td></tr><tr id="Attributes_Standard Implementation_maxKeepAliveRequests"><td><code class="attributeName">maxKeepAliveRequests</code></td><td>
		496	<p>The maximum number of HTTP requests which can be pipelined until
		497	the connection is closed by the server. Setting this attribute to 1 will
		498	disable HTTP/1.0 keep-alive, as well as HTTP/1.1 keep-alive and
		499	pipelining. Setting this to -1 will allow an unlimited amount of
		500	pipelined or keep-alive HTTP requests.
		501	If not specified, this attribute is set to 100.</p>
		502	</td></tr><tr id="Attributes_Standard Implementation_maxQueueSize"><td><code class="attributeName">maxQueueSize</code></td><td>
		503	<p>(int) The maximum number of runnable tasks that can queue up awaiting
		504	execution before they are rejected. The default value is
		505	<code>Integer.MAX_VALUE</code></p>
		506	</td></tr><tr id="Attributes_Standard Implementation_maxSwallowSize"><td><code class="attributeName">maxSwallowSize</code></td><td>
		507	<p>The maximum number of request body bytes (excluding transfer encoding
		508	overhead) that will be swallowed by Tomcat for an aborted upload. An
		509	aborted upload is when Tomcat knows that the request body is going to be
		510	ignored but the client still sends it. If Tomcat does not swallow the body
		511	the client is unlikely to see the response. If not specified the default
		512	of 2097152 (2 MiB) will be used. A value of less than zero indicates
		513	that no limit should be enforced.</p>
		514	</td></tr><tr id="Attributes_Standard Implementation_maxThreads"><td><code class="attributeName">maxThreads</code></td><td>
		515	<p>The maximum number of request processing threads to be created
		516	by this <strong>Connector</strong>, which therefore determines the
		517	maximum number of simultaneous requests that can be handled. If
		518	not specified, this attribute is set to 200. If an executor is associated
		519	with this connector, this attribute is ignored as the connector will
		520	execute tasks using the executor rather than an internal thread pool. Note
		521	that if an executor is configured any value set for this attribute will be
		522	recorded correctly but it will be reported (e.g. via JMX) as
		523	<code>-1</code> to make clear that it is not used.</p>
		524	</td></tr><tr id="Attributes_Standard Implementation_maxTrailerSize"><td><code class="attributeName">maxTrailerSize</code></td><td>
		525	<p>Limits the total length of trailing headers in the last chunk of
		526	a chunked HTTP request. This must be a positive integer value.
		527	If not specified, the default value of <code>8192</code> will be
		528	used.</p>
		529	</td></tr><tr id="Attributes_Standard Implementation_minSpareThreads"><td><code class="attributeName">minSpareThreads</code></td><td>
		530	<p>The minimum number of threads always kept running. This includes both
		531	active and idle threads. If not specified, the default of <code>10</code>
		532	is used. If an executor is associated with this connector, this attribute
		533	is ignored as the connector will execute tasks using the executor rather
		534	than an internal thread pool. Note that if an executor is configured any
		535	value set for this attribute will be recorded correctly but it will be
		536	reported (e.g. via JMX) as <code>-1</code> to make clear that it is not
		537	used.</p>
		538	</td></tr><tr id="Attributes_Standard Implementation_noCompressionStrongETag"><td><code class="attributeName">noCompressionStrongETag</code></td><td>
		539	<p>This flag configures whether resources with a strong ETag will be
		540	considered for compression. If <code>true</code>, resources with a strong
		541	ETag will not be compressed. The default value is <code>true</code>.</p>
		542	<p>This attribute is deprecated. It will be removed in Tomcat 10 onwards
		543	where it will be hard-coded to <code>true</code>.</p>
		544	</td></tr><tr id="Attributes_Standard Implementation_noCompressionUserAgents"><td><code class="attributeName">noCompressionUserAgents</code></td><td>
		545	<p>The value is a regular expression (using <code>java.util.regex</code>)
		546	matching the <code>user-agent</code> header of HTTP clients for which
		547	compression should not be used,
		548	because these clients, although they do advertise support for the
		549	feature, have a broken implementation.
		550	The default value is an empty String (regexp matching disabled).</p>
		551	</td></tr><tr id="Attributes_Standard Implementation_processorCache"><td><code class="attributeName">processorCache</code></td><td>
		552	<p>The protocol handler caches Processor objects to speed up performance.
		553	This setting dictates how many of these objects get cached.
		554	<code>-1</code> means unlimited, default is <code>200</code>.
		555	<code>0</code> means no request processor reuse. This has a very
		556	significant impact on performance and garbage collection depending on
		557	the workload, but provides additional security guarantees by avoiding
		558	reuse of all request processing objects.
		559	If not using Servlet 3.0 asynchronous processing, an appropriate value
		560	is to use the same as the maxThreads setting. If using Servlet 3.0
		561	asynchronous processing, an appropriate value is to use the larger
		562	of maxThreads and the maximum number of expected concurrent requests
		563	(synchronous and asynchronous).</p>
		564	</td></tr><tr id="Attributes_Standard Implementation_rejectIllegalHeader"><td><code class="attributeName">rejectIllegalHeader</code></td><td>
		565	<p>If an HTTP request is received that contains an illegal header name or
		566	value (e.g. the header name is not a token) this setting determines if the
		567	request will be rejected with a 400 response (<code>true</code>) or if the
		568	illegal header be ignored (<code>false</code>). The default value is
		569	<code>true</code> which will cause the request to be rejected.
		570	<br>
		571	This setting will be removed in Tomcat 11 onwards where it will be
		572	hard-coded to <code>true</code>.</p>
		573	</td></tr><tr id="Attributes_Standard Implementation_rejectIllegalHeaderName"><td><code class="attributeName">rejectIllegalHeaderName</code></td><td>
		574	<p>This attribute is deprecated. It will be removed in Tomcat 10 onwards.
		575	It is now an alias for <strong>rejectIllegalHeader</strong>.</p>
		576	</td></tr><tr id="Attributes_Standard Implementation_relaxedPathChars"><td><code class="attributeName">relaxedPathChars</code></td><td>
		577	<p>The <a href="https://tools.ietf.org/rfc/rfc7230.txt">HTTP/1.1
		578	specification</a> requires that certain characters are %nn encoded when
		579	used in URI paths. Unfortunately, many user agents including all the major
		580	browsers are not compliant with this specification and use these
		581	characters in unencoded form. To prevent Tomcat rejecting such requests,
		582	this attribute may be used to specify the additional characters to allow.
		583	If not specified, no additional characters will be allowed. The value may
		584	be any combination of the following characters:
		585	<code>" < > [ \ ] ^ ` { \| }</code> . Any other characters
		586	present in the value will be ignored.</p>
		587	</td></tr><tr id="Attributes_Standard Implementation_relaxedQueryChars"><td><code class="attributeName">relaxedQueryChars</code></td><td>
		588	<p>The <a href="https://tools.ietf.org/rfc/rfc7230.txt">HTTP/1.1
		589	specification</a> requires that certain characters are %nn encoded when
		590	used in URI query strings. Unfortunately, many user agents including all
		591	the major browsers are not compliant with this specification and use these
		592	characters in unencoded form. To prevent Tomcat rejecting such requests,
		593	this attribute may be used to specify the additional characters to allow.
		594	If not specified, no additional characters will be allowed. The value may
		595	be any combination of the following characters:
		596	<code>" < > [ \ ] ^ ` { \| }</code> . Any other characters
		597	present in the value will be ignored.</p>
		598	</td></tr><tr id="Attributes_Standard Implementation_restrictedUserAgents"><td><code class="attributeName">restrictedUserAgents</code></td><td>
		599	<p>The value is a regular expression (using <code>java.util.regex</code>)
		600	matching the <code>user-agent</code> header of HTTP clients for which
		601	HTTP/1.1 or HTTP/1.0 keep alive should not be used, even if the clients
		602	advertise support for these features.
		603	The default value is an empty String (regexp matching disabled).</p>
		604	</td></tr><tr id="Attributes_Standard Implementation_server"><td><code class="attributeName">server</code></td><td>
		605	<p>Overrides the Server header for the http response. If set, the value
		606	for this attribute overrides any Server header set by a web application.
		607	If not set, any value specified by the application is used. If the
		608	application does not specify a value then no Server header is set.</p>
		609	</td></tr><tr id="Attributes_Standard Implementation_serverRemoveAppProvidedValues"><td><code class="attributeName">serverRemoveAppProvidedValues</code></td><td>
		610	<p>If <code>true</code>, any Server header set by a web
		611	application will be removed. Note that if <strong>server</strong> is set,
		612	this attribute is effectively ignored. If not set, the default value of
		613	<code>false</code> will be used.</p>
		614	</td></tr><tr id="Attributes_Standard Implementation_SSLEnabled"><td><code class="attributeName">SSLEnabled</code></td><td>
		615	<p>Use this attribute to enable SSL traffic on a connector.
		616	To turn on SSL handshake/encryption/decryption on a connector
		617	set this value to <code>true</code>.
		618	The default value is <code>false</code>.
		619	When turning this value <code>true</code> you will want to set the
		620	<code>scheme</code> and the <code>secure</code> attributes as well
		621	to pass the correct <code>request.getScheme()</code> and
		622	<code>request.isSecure()</code> values to the servlets
		623	See <a href="#SSL_Support">SSL Support</a> for more information.
		624	</p>
		625	</td></tr><tr id="Attributes_Standard Implementation_tcpNoDelay"><td><code class="attributeName">tcpNoDelay</code></td><td>
		626	<p>If set to <code>true</code>, the TCP_NO_DELAY option will be
		627	set on the server socket, which improves performance under most
		628	circumstances. This is set to <code>true</code> by default.</p>
		629	</td></tr><tr id="Attributes_Standard Implementation_threadPriority"><td><code class="attributeName">threadPriority</code></td><td>
		630	<p>The priority of the request processing threads within the JVM.
		631	The default value is <code>5</code> (the value of the
		632	<code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
		633	for the <code>java.lang.Thread</code> class for more details on what
		634	this priority means. If an executor is associated
		635	with this connector, this attribute is ignored as the connector will
		636	execute tasks using the executor rather than an internal thread pool. Note
		637	that if an executor is configured any value set for this attribute will be
		638	recorded correctly but it will be reported (e.g. via JMX) as
		639	<code>-1</code> to make clear that it is not used.</p>
		640	</td></tr><tr id="Attributes_Standard Implementation_threadsMaxIdleTime"><td><code class="attributeName">threadsMaxIdleTime</code></td><td>
		641	<p>The amount of time in milliseconds that threads will be kept alive by
		642	the thread pool, if there are more than <code>minSpareThreads</code>
		643	threads in the executor. If not specified, the default of
		644	<code>60000</code> milliseconds is used. If an executor is associated
		645	with this connector, this attribute
		646	is ignored as the connector will execute tasks using the executor rather
		647	than an internal thread pool. Note that if an executor is configured any
		648	value set for this attribute will be recorded correctly but it will be
		649	reported (e.g. via JMX) as <code>-1</code> to make clear that it is not
		650	used.</p>
		651	</td></tr><tr id="Attributes_Standard Implementation_throwOnFailure"><td><code class="attributeName">throwOnFailure</code></td><td>
		652	<p>If the Connector experiences an Exception during a Lifecycle transition
		653	should the Exception be rethrown or logged? If not specified, the default
		654	of <code>false</code> will be used. Note that the default can be changed
		655	by the <code>org.apache.catalina.startup.EXIT_ON_INIT_FAILURE</code>
		656	system property.</p>
		657	</td></tr><tr id="Attributes_Standard Implementation_useAsyncIO"><td><code class="attributeName">useAsyncIO</code></td><td>
		658	<p>(bool) Use this attribute to enable or disable usage of the
		659	asynchronous IO API. The default value is <code>true</code> except when
		660	using the APR connector due to low performance.</p>
		661	</td></tr><tr id="Attributes_Standard Implementation_useKeepAliveResponseHeader"><td><code class="attributeName">useKeepAliveResponseHeader</code></td><td>
		662	<p>(bool) Use this attribute to enable or disable the addition of the
		663	<code>Keep-Alive</code> HTTP response header as described in
		664	<a href="https://tools.ietf.org/html/draft-thomson-hybi-http-timeout-03">this
		665	Internet-Draft</a>. The default value is <code>true</code>.</p>
		666	</td></tr><tr id="Attributes_Standard Implementation_useVirtualThreads"><td><code class="attributeName">useVirtualThreads</code></td><td>
		667	<p>(bool) Use this attribute to enable or disable usage of virtual threads
		668	with the internal executor. If an executor is associated with this
		669	connector, this attribute is ignored. The default value is
		670	<code>false</code>.</p>
		671	</td></tr></table>
		672
		673	</div></div>
		674
		675	<div class="subsection"><h4 id="Java_TCP_socket_attributes">Java TCP socket attributes</h4><div class="text">
		676
		677	<p>The NIO and NIO2 implementation support the following Java TCP
		678	socket attributes in addition to the common Connector and HTTP attributes
		679	listed above.</p>
		680
		681	<table class="defaultTable"><tr><th style="width: 15%;">
		682	Attribute
		683	</th><th style="width: 85%;">
		684	Description
		685	</th></tr><tr id="Attributes_Java TCP socket attributes_socket.rxBufSize"><td><code class="attributeName">socket.rxBufSize</code></td><td>
		686	<p>(int)The socket receive buffer (SO_RCVBUF) size in bytes. JVM default
		687	used if not set.</p>
		688	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.txBufSize"><td><code class="attributeName">socket.txBufSize</code></td><td>
		689	<p>(int)The socket send buffer (SO_SNDBUF) size in bytes. JVM default
		690	used if not set. Care should be taken if explicitly setting this value.
		691	Very poor performance has been observed on some JVMs with values less
		692	than ~8k.</p>
		693	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.tcpNoDelay"><td><code class="attributeName">socket.tcpNoDelay</code></td><td>
		694	<p>(bool)This is equivalent to standard attribute
		695	<strong>tcpNoDelay</strong>.</p>
		696	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.soKeepAlive"><td><code class="attributeName">socket.soKeepAlive</code></td><td>
		697	<p>(bool)Boolean value for the socket's keep alive setting
		698	(SO_KEEPALIVE). JVM default used if not set.</p>
		699	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.ooBInline"><td><code class="attributeName">socket.ooBInline</code></td><td>
		700	<p>(bool)Boolean value for the socket OOBINLINE setting. JVM default
		701	used if not set.</p>
		702	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.soReuseAddress"><td><code class="attributeName">socket.soReuseAddress</code></td><td>
		703	<p>(bool)Boolean value for the sockets reuse address option
		704	(SO_REUSEADDR). JVM default used if not set.</p>
		705	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.soLingerOn"><td><code class="attributeName">socket.soLingerOn</code></td><td>
		706	<p>(bool)Boolean value for the sockets so linger option (SO_LINGER).
		707	A value for the standard attribute <strong>connectionLinger</strong>
		708	that is >=0 is equivalent to setting this to <code>true</code>.
		709	A value for the standard attribute <strong>connectionLinger</strong>
		710	that is <0 is equivalent to setting this to <code>false</code>.
		711	Both this attribute and <code>soLingerTime</code> must be set else the
		712	JVM defaults will be used for both.</p>
		713	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.soLingerTime"><td><code class="attributeName">socket.soLingerTime</code></td><td>
		714	<p>(int)Value in seconds for the sockets so linger option (SO_LINGER).
		715	This is equivalent to standard attribute
		716	<strong>connectionLinger</strong>.
		717	Both this attribute and <code>soLingerOn</code> must be set else the
		718	JVM defaults will be used for both.</p>
		719	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.soTimeout"><td><code class="attributeName">socket.soTimeout</code></td><td>
		720	<p>This is equivalent to standard attribute
		721	<strong>connectionTimeout</strong>.</p>
		722	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.performanceConnectionTime"><td><code class="attributeName">socket.performanceConnectionTime</code></td><td>
		723	<p>(int)The first value for the performance settings. See
		724	<a href="https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
		725	All three performance attributes must be set else the JVM defaults will
		726	be used for all three.</p>
		727	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.performanceLatency"><td><code class="attributeName">socket.performanceLatency</code></td><td>
		728	<p>(int)The second value for the performance settings. See
		729	<a href="https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
		730	All three performance attributes must be set else the JVM defaults will
		731	be used for all three.</p>
		732	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.performanceBandwidth"><td><code class="attributeName">socket.performanceBandwidth</code></td><td>
		733	<p>(int)The third value for the performance settings. See
		734	<a href="https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
		735	All three performance attributes must be set else the JVM defaults will
		736	be used for all three.</p>
		737	</td></tr><tr id="Attributes_Java TCP socket attributes_socket.unlockTimeout"><td><code class="attributeName">socket.unlockTimeout</code></td><td>
		738	<p>(int) The timeout for a socket unlock. When a connector is stopped,
		739	it will try to release the acceptor thread by opening a connector to
		740	itself. The default value is <code>250</code> and the value is in
		741	milliseconds. This vaoue must be positive. Negative or zero values will
		742	be ignored.</p>
		743	</td></tr></table>
		744	</div></div>
		745
		746	<div class="subsection"><h4 id="NIO_specific_configuration">NIO specific configuration</h4><div class="text">
		747
		748	<p>The following attributes are specific to the NIO connector.</p>
		749
		750	<table class="defaultTable"><tr><th style="width: 15%;">
		751	Attribute
		752	</th><th style="width: 85%;">
		753	Description
		754	</th></tr><tr id="Attributes_NIO specific configuration_pollerThreadPriority"><td><code class="attributeName">pollerThreadPriority</code></td><td>
		755	<p>(int)The priority of the poller threads.
		756	The default value is <code>5</code> (the value of the
		757	<code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
		758	for the <code>java.lang.Thread</code> class for more details on what
		759	this priority means.</p>
		760	</td></tr><tr id="Attributes_NIO specific configuration_selectorTimeout"><td><code class="attributeName">selectorTimeout</code></td><td>
		761	<p>(int)The time in milliseconds to timeout on a select() for the
		762	poller. This value is important, since connection clean up is done on
		763	the same thread, so do not set this value to an extremely high one. The
		764	default value is <code>1000</code> milliseconds.</p>
		765	</td></tr><tr id="Attributes_NIO specific configuration_useSendfile"><td><code class="attributeName">useSendfile</code></td><td>
		766	<p>(bool)Use this attribute to enable or disable sendfile capability.
		767	The default value is <code>true</code>. Note that the use of sendfile
		768	will disable any compression that Tomcat may otherwise have performed on
		769	the response.</p>
		770	</td></tr><tr id="Attributes_NIO specific configuration_socket.directBuffer"><td><code class="attributeName">socket.directBuffer</code></td><td>
		771	<p>(bool)Boolean value, whether to use direct ByteBuffers or java mapped
		772	ByteBuffers. If <code>true</code> then
		773	<code>java.nio.ByteBuffer.allocateDirect()</code> is used to allocate
		774	the buffers, if <code>false</code> then
		775	<code>java.nio.ByteBuffer.allocate()</code> is used. The default value
		776	is <code>false</code>.<br>
		777	When you are using direct buffers, make sure you allocate the
		778	appropriate amount of memory for the direct memory space. On Sun's JDK
		779	that would be something like <code>-XX:MaxDirectMemorySize=256m</code>.
		780	</p>
		781	</td></tr><tr id="Attributes_NIO specific configuration_socket.directSslBuffer"><td><code class="attributeName">socket.directSslBuffer</code></td><td>
		782	<p>(bool)Boolean value, whether to use direct ByteBuffers or java mapped
		783	ByteBuffers for the SSL buffers. If <code>true</code> then
		784	<code>java.nio.ByteBuffer.allocateDirect()</code> is used to allocate
		785	the buffers, if <code>false</code> then
		786	<code>java.nio.ByteBuffer.allocate()</code> is used. The default value
		787	is <code>false</code>.<br>
		788	When you are using direct buffers, make sure you allocate the
		789	appropriate amount of memory for the direct memory space. On Oracle's JDK
		790	that would be something like <code>-XX:MaxDirectMemorySize=256m</code>.
		791	</p>
		792	</td></tr><tr id="Attributes_NIO specific configuration_socket.appReadBufSize"><td><code class="attributeName">socket.appReadBufSize</code></td><td>
		793	<p>(int)Each connection that is opened up in Tomcat get associated with
		794	a read ByteBuffer. This attribute controls the size of this buffer. By
		795	default this read buffer is sized at <code>8192</code> bytes. For lower
		796	concurrency, you can increase this to buffer more data. For an extreme
		797	amount of keep alive connections, decrease this number or increase your
		798	heap size.</p>
		799	</td></tr><tr id="Attributes_NIO specific configuration_socket.appWriteBufSize"><td><code class="attributeName">socket.appWriteBufSize</code></td><td>
		800	<p>(int)Each connection that is opened up in Tomcat get associated with
		801	a write ByteBuffer. This attribute controls the size of this buffer. By
		802	default this write buffer is sized at <code>8192</code> bytes. For low
		803	concurrency you can increase this to buffer more response data. For an
		804	extreme amount of keep alive connections, decrease this number or
		805	increase your heap size.<br>
		806	The default value here is pretty low, you should up it if you are not
		807	dealing with tens of thousands concurrent connections.</p>
		808	</td></tr><tr id="Attributes_NIO specific configuration_socket.bufferPool"><td><code class="attributeName">socket.bufferPool</code></td><td>
		809	<p>(int)The NIO connector uses a class called NioChannel that holds
		810	elements linked to a socket. To reduce garbage collection, the NIO
		811	connector caches these channel objects. This value specifies the size of
		812	this cache. The default value is <code>500</code>, and represents that
		813	the cache will hold 500 NioChannel objects. Other values are
		814	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		815	</td></tr><tr id="Attributes_NIO specific configuration_socket.bufferPoolSize"><td><code class="attributeName">socket.bufferPoolSize</code></td><td>
		816	<p>(int)The NioChannel pool can also be size based, not used object
		817	based. The size is calculated as follows:<br>
		818	NioChannel
		819	<code>buffer size = read buffer size + write buffer size</code><br>
		820	SecureNioChannel <code>buffer size = application read buffer size +
		821	application write buffer size + network read buffer size +
		822	network write buffer size</code><br>
		823	The value is in bytes, the default value is <code>10241024100</code>
		824	(100MB).</p>
		825	</td></tr><tr id="Attributes_NIO specific configuration_socket.processorCache"><td><code class="attributeName">socket.processorCache</code></td><td>
		826	<p>(int)Tomcat will cache SocketProcessor objects to reduce garbage
		827	collection. The integer value specifies how many objects to keep in the
		828	cache at most. The default is <code>500</code>. Other values are
		829	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		830	</td></tr><tr id="Attributes_NIO specific configuration_socket.keyCache"><td><code class="attributeName">socket.keyCache</code></td><td>
		831	<p>(int)Tomcat will cache KeyAttachment objects to reduce garbage
		832	collection. The integer value specifies how many objects to keep in the
		833	cache at most. The default is <code>500</code>. Other values are
		834	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		835	</td></tr><tr id="Attributes_NIO specific configuration_socket.eventCache"><td><code class="attributeName">socket.eventCache</code></td><td>
		836	<p>(int)Tomcat will cache PollerEvent objects to reduce garbage
		837	collection. The integer value specifies how many objects to keep in the
		838	cache at most. The default is <code>500</code>. Other values are
		839	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		840	</td></tr><tr id="Attributes_NIO specific configuration_unixDomainSocketPath"><td><code class="attributeName">unixDomainSocketPath</code></td><td>
		841	<p>Where supported, the path to a Unix Domain Socket that this
		842	<strong>Connector</strong> will create and await incoming connections.
		843	When this is specified, the otherwise mandatory <code>port</code>
		844	attribute may be omitted.</p>
		845	</td></tr><tr id="Attributes_NIO specific configuration_unixDomainSocketPathPermissions"><td><code class="attributeName">unixDomainSocketPathPermissions</code></td><td>
		846	<p>Where supported, the posix permissions that will be applied to the
		847	to the Unix Domain Socket specified with
		848	<code>unixDomainSocketPath</code> above. The
		849	permissions are specified as a string of nine characters, in three sets
		850	of three: (r)ead, (w)rite and e(x)ecute for owner, group and others
		851	respectively. If a permission is not granted, a hyphen is used. If
		852	unspecified, the permissions default to <code>rw-rw-rw-</code>.</p>
		853	</td></tr><tr id="Attributes_NIO specific configuration_useInheritedChannel"><td><code class="attributeName">useInheritedChannel</code></td><td>
		854	<p>(bool)Defines if this connector should inherit an inetd/systemd network socket.
		855	Only one connector can inherit a network socket. This can option can be
		856	used to automatically start Tomcat once a connection request is made to
		857	the systemd super daemon's port.
		858	The default value is <code>false</code>. See the JavaDoc
		859	for the <code>java.nio.channels.spi.SelectorProvider</code> class for
		860	more details.</p>
		861	</td></tr></table>
		862	</div></div>
		863
		864	<div class="subsection"><h4 id="NIO2_specific_configuration">NIO2 specific configuration</h4><div class="text">
		865
		866	<p>The following attributes are specific to the NIO2 connector.</p>
		867
		868	<table class="defaultTable"><tr><th style="width: 15%;">
		869	Attribute
		870	</th><th style="width: 85%;">
		871	Description
		872	</th></tr><tr id="Attributes_NIO2 specific configuration_useSendfile"><td><code class="attributeName">useSendfile</code></td><td>
		873	<p>(bool)Use this attribute to enable or disable sendfile capability.
		874	The default value is <code>true</code>. Note that the use of sendfile
		875	will disable any compression that Tomcat may otherwise have performed on
		876	the response.</p>
		877	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.directBuffer"><td><code class="attributeName">socket.directBuffer</code></td><td>
		878	<p>(bool)Boolean value, whether to use direct ByteBuffers or java mapped
		879	ByteBuffers. If <code>true</code> then
		880	<code>java.nio.ByteBuffer.allocateDirect()</code> is used to allocate
		881	the buffers, if <code>false</code> then
		882	<code>java.nio.ByteBuffer.allocate()</code> is used. The default value
		883	is <code>false</code>.<br>
		884	When you are using direct buffers, make sure you allocate the
		885	appropriate amount of memory for the direct memory space. On Sun's JDK
		886	that would be something like <code>-XX:MaxDirectMemorySize=256m</code>.
		887	</p>
		888	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.directSslBuffer"><td><code class="attributeName">socket.directSslBuffer</code></td><td>
		889	<p>(bool)Boolean value, whether to use direct ByteBuffers or java mapped
		890	ByteBuffers for the SSL buffers. If <code>true</code> then
		891	<code>java.nio.ByteBuffer.allocateDirect()</code> is used to allocate
		892	the buffers, if <code>false</code> then
		893	<code>java.nio.ByteBuffer.allocate()</code> is used. The default value
		894	is <code>false</code>.<br>
		895	When you are using direct buffers, make sure you allocate the
		896	appropriate amount of memory for the direct memory space. On Oracle's JDK
		897	that would be something like <code>-XX:MaxDirectMemorySize=256m</code>.
		898	</p>
		899	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.appReadBufSize"><td><code class="attributeName">socket.appReadBufSize</code></td><td>
		900	<p>(int)Each connection that is opened up in Tomcat get associated with
		901	a read ByteBuffer. This attribute controls the size of this buffer. By
		902	default this read buffer is sized at <code>8192</code> bytes. For lower
		903	concurrency, you can increase this to buffer more data. For an extreme
		904	amount of keep alive connections, decrease this number or increase your
		905	heap size.</p>
		906	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.appWriteBufSize"><td><code class="attributeName">socket.appWriteBufSize</code></td><td>
		907	<p>(int)Each connection that is opened up in Tomcat get associated with
		908	a write ByteBuffer. This attribute controls the size of this buffer. By
		909	default this write buffer is sized at <code>8192</code> bytes. For low
		910	concurrency you can increase this to buffer more response data. For an
		911	extreme amount of keep alive connections, decrease this number or
		912	increase your heap size.<br>
		913	The default value here is pretty low, you should up it if you are not
		914	dealing with tens of thousands concurrent connections.</p>
		915	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.bufferPool"><td><code class="attributeName">socket.bufferPool</code></td><td>
		916	<p>(int)The NIO2 connector uses a class called Nio2Channel that holds
		917	elements linked to a socket. To reduce garbage collection, the NIO2
		918	connector caches these channel objects. This value specifies the size of
		919	this cache. The default value is <code>500</code>, and represents that
		920	the cache will hold 500 Nio2Channel objects. Other values are
		921	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		922	</td></tr><tr id="Attributes_NIO2 specific configuration_socket.processorCache"><td><code class="attributeName">socket.processorCache</code></td><td>
		923	<p>(int)Tomcat will cache SocketProcessor objects to reduce garbage
		924	collection. The integer value specifies how many objects to keep in the
		925	cache at most. The default is <code>500</code>. Other values are
		926	<code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
		927	</td></tr></table>
		928	</div></div>
		929
		930	<div class="subsection"><h4 id="APR/native_specific_configuration">APR/native specific configuration</h4><div class="text">
		931
		932	<p>The following attributes are specific to the APR/native connector.</p>
		933
		934	<table class="defaultTable"><tr><th style="width: 15%;">
		935	Attribute
		936	</th><th style="width: 85%;">
		937	Description
		938	</th></tr><tr id="Attributes_APR/native specific configuration_deferAccept"><td><code class="attributeName">deferAccept</code></td><td>
		939	<p>Sets the <code>TCP_DEFER_ACCEPT</code> flag on the listening socket
		940	for this connector. The default value is <code>true</code> where
		941	<code>TCP_DEFER_ACCEPT</code> is supported by the operating system,
		942	otherwise it is <code>false</code>.</p>
		943	</td></tr><tr id="Attributes_APR/native specific configuration_ipv6v6only"><td><code class="attributeName">ipv6v6only</code></td><td>
		944	<p>If listening on an IPv6 address on a dual stack system, should the
		945	connector only listen on the IPv6 address? If not specified the default
		946	is <code>false</code> and the connector will listen on the IPv6 address
		947	and the equivalent IPv4 address if present.</p>
		948	</td></tr><tr id="Attributes_APR/native specific configuration_pollerThreadCount"><td><code class="attributeName">pollerThreadCount</code></td><td>
		949	<p>Number of threads used to poll kept alive connections. On Windows the
		950	default is chosen so that the sockets managed by each thread is
		951	less than 1024. For Linux the default is 1. Changing the default on
		952	Windows is likely to have a negative performance impact.</p>
		953	</td></tr><tr id="Attributes_APR/native specific configuration_pollTime"><td><code class="attributeName">pollTime</code></td><td>
		954	<p>Duration of a poll call in microseconds. Lowering this value will
		955	slightly decrease latency of connections being kept alive in some cases,
		956	but will use more CPU as more poll calls are being made. The default
		957	value is 2000 (2ms).</p>
		958	</td></tr><tr id="Attributes_APR/native specific configuration_sendfileSize"><td><code class="attributeName">sendfileSize</code></td><td>
		959	<p>Amount of sockets that the poller responsible for sending static
		960	files asynchronously can hold at a given time. Extra connections will be
		961	closed right away without any data being sent (resulting in a zero
		962	length file on the client side). Note that in most cases, sendfile is a
		963	call that will return right away (being taken care of "synchronously" by
		964	the kernel), and the sendfile poller will not be used, so the amount of
		965	static files which can be sent concurrently is much larger than the
		966	specified amount. The default value is 1024.</p>
		967	</td></tr><tr id="Attributes_APR/native specific configuration_threadPriority"><td><code class="attributeName">threadPriority</code></td><td>
		968	<p>(int)The priority of the acceptor and poller threads.
		969	The default value is <code>5</code> (the value of the
		970	<code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
		971	for the <code>java.lang.Thread</code> class for more details on what
		972	this priority means.</p>
		973	</td></tr><tr id="Attributes_APR/native specific configuration_useSendfile"><td><code class="attributeName">useSendfile</code></td><td>
		974	<p>(bool)Use this attribute to enable or disable sendfile capability.
		975	The default value is <code>true</code>. Note that the use of sendfile
		976	will disable any compression that Tomcat may otherwise have performed on
		977	the response.</p>
		978	</td></tr></table>
		979
		980	</div></div>
		981
		982	</div><h3 id="Nested_Components">Nested Components</h3><div class="text">
		983
		984	<p>First implemented in Tomcat 9 and back-ported to 8.5, Tomcat now supports
		985	Server Name Indication (SNI). This allows multiple SSL configurations to be
		986	associated with a single secure connector with the configuration used for any
		987	given connection determined by the host name requested by the client. To
		988	facilitate this, the <strong>SSLHostConfig</strong> element was added which
		989	can be used to define one of these configurations. Any number of
		990	<strong>SSLHostConfig</strong> may be nested in a <strong>Connector</strong>.
		991	At the same time, support was added for multiple certificates to be associated
		992	with a single <strong>SSLHostConfig</strong>. Each SSL certificate is
		993	therefore configured in a <strong>Certificate</strong> element with in an
		994	<strong>SSLHostConfig</strong>. For further information, see the SSL Support
		995	section below.</p>
		996
		997	<p>When OpenSSL is providing the TLS implementation, one or more
		998	<strong>OpenSSLConfCmd</strong> elements may be nested inside a
		999	<strong>OpenSSLConf</strong> element to configure OpenSSL via OpenSSL's
		1000	<code>SSL_CONF</code> API. A single <strong>OpenSSLConf</strong> element may
		1001	be nested in a <strong>SSLHostConfig</strong> element. For further
		1002	information, see the SSL Support section below</p>
		1003
		1004	</div><h3 id="Special_Features">Special Features</h3><div class="text">
		1005
		1006
		1007	<div class="subsection"><h4 id="HTTP/1.1_and_HTTP/1.0_Support">HTTP/1.1 and HTTP/1.0 Support</h4><div class="text">
		1008
		1009	<p>This <strong>Connector</strong> supports all of the required features
		1010	of the HTTP/1.1 protocol, as described in RFCs 7230-7235, including persistent
		1011	connections, pipelining, expectations and chunked encoding. If the client
		1012	supports only HTTP/1.0 or HTTP/0.9, the
		1013	<strong>Connector</strong> will gracefully fall back to supporting this
		1014	protocol as well. No special configuration is required to enable this
		1015	support. The <strong>Connector</strong> also supports HTTP/1.0
		1016	keep-alive.</p>
		1017
		1018	<p>RFC 7230 requires that HTTP servers always begin their responses with
		1019	the highest HTTP version that they claim to support. Therefore, this
		1020	<strong>Connector</strong> will always return <code>HTTP/1.1</code> at
		1021	the beginning of its responses.</p>
		1022
		1023	</div></div>
		1024
		1025	<div class="subsection"><h4 id="HTTP/2_Support">HTTP/2 Support</h4><div class="text">
		1026
		1027	<p>HTTP/2 support is provided for TLS (h2), non-TLS via HTTP upgrade (h2c)
		1028	and direct HTTP/2 (h2c) connections. To enable HTTP/2 support for an HTTP
		1029	connector the following <strong>UpgradeProtocol</strong> element must be
		1030	nested within the <strong>Connector</strong> with a
		1031	<strong>className</strong> attribute of
		1032	<code>org.apache.coyote.http2.Http2Protocol</code>.</p>
		1033
		1034	<div class="codeBox"><pre><code><Connector ... >
		1035	<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
		1036	</Connector></code></pre></div>
		1037
		1038	<p>Because Java 8's TLS implementation does not support ALPN (which is
		1039	required for HTTP/2 over TLS), you must be using an OpenSSL based TLS
		1040	implementation to enable HTTP/2 support. See the
		1041	<code>sslImplementationName</code> attribute of the
		1042	<strong>Connector</strong>.</p>
		1043
		1044	<p>Additional configuration attributes are available. See the
		1045	<a href="http2.html">HTTP/2 Upgrade Protocol</a> documentation for details.</p>
		1046
		1047	</div></div>
		1048
		1049	<div class="subsection"><h4 id="Proxy_Support">Proxy Support</h4><div class="text">
		1050
		1051	<p>The <code>proxyName</code> and <code>proxyPort</code> attributes can
		1052	be used when Tomcat is run behind a proxy server. These attributes
		1053	modify the values returned to web applications that call the
		1054	<code>request.getServerName()</code> and <code>request.getServerPort()</code>
		1055	methods, which are often used to construct absolute URLs for redirects.
		1056	Without configuring these attributes, the values returned would reflect
		1057	the server name and port on which the connection from the proxy server
		1058	was received, rather than the server name and port to whom the client
		1059	directed the original request.</p>
		1060
		1061	<p>For more information, see the
		1062	<a href="../proxy-howto.html">Proxy Support How-To</a>.</p>
		1063
		1064	</div></div>
		1065
		1066
		1067	<div class="subsection"><h4 id="Unix_Domain_Socket_Support">Unix Domain Socket Support</h4><div class="text">
		1068
		1069	<p>When the <code>unixDomainSocketPath</code> attribute is used, connectors
		1070	that support Unix Domain Sockets will bind to the socket at the given path.
		1071	</p>
		1072
		1073	<p>For users of Java 16 and higher, support is provided within the NIO
		1074	connectors. For users of Java earlier than 16, support is provided by
		1075	the <code>org.apache.coyote.http11.Http11AprProtocol</code> connector when
		1076	used with the Apache Tomcat Native library v1.2.26 and up, along with
		1077	Apache Portable Runtime v1.6 and higher.
		1078	</p>
		1079
		1080	<p>The socket path is created with read and write permissions for all
		1081	users. To protect this socket, place it in a directory with suitable
		1082	permissions appropriately configured to restrict access as required.
		1083	Alternatively, on platforms that support posix permissions, the
		1084	permissions on the socket can be set directly with the
		1085	<code>unixDomainSocketPathPermissions</code> option.
		1086	</p>
		1087
		1088	<p>Tomcat will automatically remove the socket on server shutdown. If the
		1089	socket already exists startup will fail. Care must be taken by the
		1090	administrator to remove the socket after verifying that the socket isn't
		1091	already being used by an existing Tomcat process.</p>
		1092
		1093	<p>The Unix Domain Socket can be accessed using the
		1094	<code>--unix-socket</code> option of the <code>curl</code> command line
		1095	client, and the Unix Domain Socket support in Apache HTTP server's
		1096	<code>mod_proxy</code> module.
		1097	</p>
		1098
		1099	</div></div>
		1100
		1101
		1102	<div class="subsection"><h4 id="SSL_Support">SSL Support</h4><div class="text">
		1103
		1104	<p>You can enable SSL support for a particular instance of this
		1105	<strong>Connector</strong> by setting the <code>SSLEnabled</code> attribute to
		1106	<code>true</code>.</p>
		1107
		1108	<p>You will also need to set the <code>scheme</code> and <code>secure</code>
		1109	attributes to the values <code>https</code> and <code>true</code>
		1110	respectively, to pass correct information to the servlets.</p>
		1111
		1112	<p>The NIO and NIO2 connectors use either the JSSE Java SSL implementation or
		1113	an OpenSSL implementation, whereas the APR/native connector uses OpenSSL only.
		1114	Prior to Tomcat 8.5, different configuration attributes were used for JSSE and
		1115	OpenSSL. From Tomcat 8.5 onwards, and as far as possible, common configuration
		1116	attributes are used for both JSSE and OpenSSL. Also if using the JSSE OpenSSL
		1117	implementation, configuration can be set using either the JSSE or APR
		1118	attributes (note: but not both types within the same configuration). This is
		1119	to aid simpler switching between connector implementations for SSL
		1120	connectors.</p>
		1121
		1122	<p>Each secure connector must define at least one
		1123	<strong>SSLHostConfig</strong>. The names of the
		1124	<strong>SSLHostConfig</strong> elements must be unique and one of them must
		1125	match the <code>defaultSSLHostConfigName</code> attribute of the
		1126	<strong>Connector</strong>.</p>
		1127
		1128	<p>Each <strong>SSLHostConfig</strong> must in turn define at least one
		1129	<strong>Certificate</strong>. The types of the <strong>Certificate</strong>s
		1130	must be unique.</p>
		1131
		1132	<p>As of Tomcat 8.5, the majority of the SSL configuration attributes in the
		1133	<strong>Connector</strong> are deprecated. If specified, they will be used to
		1134	configure a <strong>SSLHostConfig</strong> and <strong>Certificate</strong>
		1135	for the <code>defaultSSLHostConfigName</code>. Note that if an explicit
		1136	<strong>SSLHostConfig</strong> element also exists for the
		1137	<code>defaultSSLHostConfigName</code> then that will be treated as a configuration
		1138	error. It is expected that Tomcat 10 will drop support for the SSL
		1139	configuration attributes in the <strong>Connector</strong>.</p>
		1140
		1141	<p>In addition to the standard TLS related request attributes defined in
		1142	section 3.10 of the Servlet specification, Tomcat supports a number of
		1143	additional TLS related attributes. The full list may be found in the <a href="http://tomcat.apache.org/tomcat-10.0-doc/api/index.html">SSLSupport
		1144	Javadoc</a>.</p>
		1145
		1146	<p>For more information, see the
		1147	<a href="../ssl-howto.html">SSL Configuration How-To</a>.</p>
		1148
		1149	</div></div>
		1150
		1151	<div class="subsection"><h4 id="SSL_Support_-_SSLHostConfig">SSL Support - SSLHostConfig</h4><div class="text">
		1152
		1153	<p></p>
		1154
		1155	<table class="defaultTable"><tr><th style="width: 15%;">
		1156	Attribute
		1157	</th><th style="width: 85%;">
		1158	Description
		1159	</th></tr><tr id="Special Features_SSL Support - SSLHostConfig_certificateRevocationListFile"><td><code class="attributeName">certificateRevocationListFile</code></td><td>
		1160	<p>Name of the file that contains the concatenated certificate revocation
		1161	lists for the certificate authorities. The format is PEM-encoded. If not
		1162	defined, client certificates will not be checked against a certificate
		1163	revocation list (unless an OpenSSL based connector is used and
		1164	<strong>certificateRevocationListPath</strong> is defined). Relative paths
		1165	will be resolved against <code>$CATALINA_BASE</code>. JSSE based
		1166	connectors may also specify a URL for this attribute.</p>
		1167	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_certificateRevocationListPath"><td><code class="attributeName">certificateRevocationListPath</code></td><td>
		1168	<p>OpenSSL only.</p>
		1169	<p>Name of the directory that contains the certificate revocation lists
		1170	for the certificate authorities. The format is PEM-encoded. Relative paths
		1171	will be resolved against <code>$CATALINA_BASE</code>.</p>
		1172	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_certificateVerification"><td><code class="attributeName">certificateVerification</code></td><td>
		1173	<p>Set to <code>required</code> if you want the SSL stack to require a
		1174	valid certificate chain from the client before accepting a connection.
		1175	Set to <code>optional</code> if you want the SSL stack to request a client
		1176	Certificate, but not fail if one isn't presented. Set to
		1177	<code>optionalNoCA</code> if you want client certificates to be optional
		1178	and you don't want Tomcat to check them against the list of trusted CAs.
		1179	If the TLS provider doesn't support this option (OpenSSL does, JSSE does
		1180	not) it is treated as if <code>optional</code> was specified. If
		1181	<code>optionalNoCA</code> is configured then OCSP will also be disabled.
		1182	<code>none</code> value (which is the default) will not require a
		1183	certificate chain unless the client requests a resource protected by a
		1184	security constraint that uses <code>CLIENT-CERT</code> authentication.</p>
		1185	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_certificateVerificationDepth"><td><code class="attributeName">certificateVerificationDepth</code></td><td>
		1186	<p>The maximum number of intermediate certificates that will be allowed
		1187	when validating client certificates. If not specified, the default value
		1188	of 10 will be used.</p>
		1189	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_caCertificateFile"><td><code class="attributeName">caCertificateFile</code></td><td>
		1190	<p>OpenSSL only.</p>
		1191	<p>Name of the file that contains the concatenated certificates for the
		1192	trusted certificate authorities. The format is PEM-encoded.</p>
		1193	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_caCertificatePath"><td><code class="attributeName">caCertificatePath</code></td><td>
		1194	<p>OpenSSL only.</p>
		1195	<p>Name of the directory that contains the certificates for the trusted
		1196	certificate authorities. The format is PEM-encoded.</p>
		1197	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_ciphers"><td><code class="attributeName">ciphers</code></td><td>
		1198	<p>The ciphers to enable using the OpenSSL syntax. (See the OpenSSL
		1199	documentation for the list of ciphers supported and the syntax).
		1200	Alternatively, a comma separated list of ciphers using the standard
		1201	OpenSSL cipher names or the standard JSSE cipher names may be used.</p>
		1202	<p>Different versions of OpenSSL may interpret the same cipher string
		1203	differently. For example, the <code>CCM8</code> ciphers were moved from
		1204	<code>HIGH</code> to <code>MEDIUM</code> in OpenSSL 3.2. Regardless of
		1205	the OpenSSL or JSSE version used, Tomcat converts the provided cipher
		1206	value to a list of ciphers in a manner consistent with the latest OpenSSL
		1207	development branch. This list of ciphers is then passed to the SSL
		1208	implementation.</p>
		1209	<p>Only the ciphers that are supported by the SSL implementation will be
		1210	used. Any ciphers in the list derived from a non-default cipher string
		1211	that are not supported by the SSL implementation will be logged in a
		1212	<code>WARNING</code> message when the Connector starts. The warning can be
		1213	avoided by providing an explicit list of ciphers that are supported by the
		1214	configured SSL implementation.</p>
		1215	<p>If not specified, a default (using the OpenSSL notation) of
		1216	<code>HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA</code> will be
		1217	used.</p>
		1218	<p>Note that, by default, the order in which ciphers are defined is
		1219	treated as an order of preference. See <code>honorCipherOrder</code>.</p>
		1220	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_disableCompression"><td><code class="attributeName">disableCompression</code></td><td>
		1221	<p>OpenSSL only.</p>
		1222	<p>Configures if compression is disabled. The default is
		1223	<code>true</code>. If the OpenSSL version used does not support disabling
		1224	compression then the default for that OpenSSL version will be used.</p>
		1225	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_disableSessionTickets"><td><code class="attributeName">disableSessionTickets</code></td><td>
		1226	<p>OpenSSL only.</p>
		1227	<p>Disables use of TLS session tickets (RFC 5077) if set to
		1228	<code>true</code>. Default is <code>false</code>. Note that when TLS
		1229	session tickets are in use, the full peer certificate chain will only be
		1230	available on the first connection. Subsequent connections (that use a
		1231	ticket to estrablish the TLS session) will only have the peer certificate,
		1232	not the full chain.</p>
		1233	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_groups"><td><code class="attributeName">groups</code></td><td>
		1234	<p>JSSE only.</p>
		1235	<p>Allows only allowing certain named groups. The value should be a case
		1236	sensitive comma separated list of the names of the groups.</p>
		1237	<p>. If not specified, the default named groups of the provider will be
		1238	used, and any named groups specified by the client will be passed to it.
		1239	</p>
		1240	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_honorCipherOrder"><td><code class="attributeName">honorCipherOrder</code></td><td>
		1241	<p>Set to <code>true</code> to enforce the server's cipher order
		1242	(from the <code>ciphers</code> setting) instead of allowing
		1243	the client to choose the cipher. The default is <code>false</code>.</p>
		1244	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_hostName"><td><code class="attributeName">hostName</code></td><td>
		1245	<p>The name of the SSL Host. This should either be the fully qualified
		1246	domain name (e.g. <code>tomcat.apache.org</code>) or a wild card domain
		1247	name (e.g. <code>*.apache.org</code>). If not specified, the default value
		1248	of <code>_default_</code> will be used. Provided values are always
		1249	converted to lower case.</p>
		1250	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_insecureRenegotiation"><td><code class="attributeName">insecureRenegotiation</code></td><td>
		1251	<p>OpenSSL only.</p>
		1252	<p>Configures if insecure renegotiation is allowed. The default is
		1253	<code>false</code>. If the OpenSSL version used does not support
		1254	configuring if insecure renegotiation is allowed then the default for that
		1255	OpenSSL version will be used.</p>
		1256	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_keyManagerAlgorithm"><td><code class="attributeName">keyManagerAlgorithm</code></td><td>
		1257	<p>JSSE only.</p>
		1258	<p>The <code>KeyManager</code> algorithm to be used. This defaults to
		1259	<code>KeyManagerFactory.getDefaultAlgorithm()</code> which returns
		1260	<code>SunX509</code> for Sun JVMs. IBM JVMs return
		1261	<code>IbmX509</code>. For other vendors, consult the JVM
		1262	documentation for the default value.</p>
		1263	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_protocols"><td><code class="attributeName">protocols</code></td><td>
		1264	<p>The names of the protocols to support when communicating with clients.
		1265	This should be a list of any combination of the following:
		1266	</p>
		1267	<ul><li>SSLv2Hello</li><li>SSLv3</li><li>TLSv1</li><li>TLSv1.1</li>
		1268	<li>TLSv1.2</li><li>TLSv1.3</li><li>all</li></ul>
		1269	<p>Each token in the list can be prefixed with a plus sign ("+")
		1270	or a minus sign ("-"). A plus sign adds the protocol, a minus sign
		1271	removes it form the current list. The list is built starting from
		1272	an empty list.</p>
		1273	<p>The token <code>all</code> is an alias for
		1274	<code>SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2,TLSv1.3</code>.</p>
		1275	<p>Note that <code>TLSv1.3</code> is only supported for JSSE when using a
		1276	JVM that implements <code>TLSv1.3</code>.</p>
		1277	<p>Note that <code>SSLv2Hello</code> will be ignored for OpenSSL based
		1278	secure connectors. If more than one protocol is specified for an OpenSSL
		1279	based secure connector it will always support <code>SSLv2Hello</code>. If a
		1280	single protocol is specified it will not support
		1281	<code>SSLv2Hello</code>.</p>
		1282	<p>Note that <code>SSLv2</code> and <code>SSLv3</code> are inherently
		1283	unsafe.</p>
		1284	<p>If not specified, the default value of <code>all</code> will be
		1285	used.</p>
		1286	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_revocationEnabled"><td><code class="attributeName">revocationEnabled</code></td><td>
		1287	<p>JSSE only.</p>
		1288	<p>Should the JSSE provider enable certificate revocation checks? If
		1289	<strong>certificateRevocationListFile</strong> is set then this attribute
		1290	is ignored and revocation checks are always enabled. This attribute is
		1291	intended to enable revocation checks that have been configured for the
		1292	current JSSE provider via other means. If not specified, a default of
		1293	<code>false</code> is used.</p>
		1294	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_sessionCacheSize"><td><code class="attributeName">sessionCacheSize</code></td><td>
		1295	<p>The number of SSL sessions to maintain in the session cache. Specify
		1296	<code>-1</code> to use the implementation default. Values of zero and
		1297	above are passed to the implementation. Zero is used to specify an
		1298	unlimited cache size and is not recommended. If not specified, a default
		1299	of <code>-1</code> is used.</p>
		1300	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_sessionTimeout"><td><code class="attributeName">sessionTimeout</code></td><td>
		1301	<p>The time, in seconds, after the creation of an SSL session that it will
		1302	timeout. Specify <code>-1</code> to use the implementation default. Values
		1303	of zero and above are passed to the implementation. Zero is used to
		1304	specify an unlimited timeout and is not recommended. If not specified, a
		1305	default of 86400 (24 hours) is used.</p>
		1306	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_sslProtocol"><td><code class="attributeName">sslProtocol</code></td><td>
		1307	<p>JSSE only.</p>
		1308	<p>The SSL protocol(s) to use (a single value may enable multiple
		1309	protocols - see the JVM documentation for details). If not specified, the
		1310	default is <code>TLS</code>. The permitted values may be obtained from the
		1311	JVM documentation for the allowed values for algorithm when creating an
		1312	<code>SSLContext</code> instance e.g.
		1313	<a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SSLContext">
		1314	Oracle Java 7</a>. Note: There is overlap between this attribute and
		1315	<code>protocols</code>.</p>
		1316	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_trustManagerClassName"><td><code class="attributeName">trustManagerClassName</code></td><td>
		1317	<p>JSSE only.</p>
		1318	<p>The name of a custom trust manager class to use to validate client
		1319	certificates. The class must have a zero argument constructor and must
		1320	also implement <code>javax.net.ssl.X509TrustManager</code>. If this
		1321	attribute is set, the trust store attributes may be ignored.</p>
		1322	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_truststoreAlgorithm"><td><code class="attributeName">truststoreAlgorithm</code></td><td>
		1323	<p>JSSE only.</p>
		1324	<p>The algorithm to use for truststore. If not specified, the default
		1325	value returned by
		1326	<code>javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm()</code> is
		1327	used.</p>
		1328	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_truststoreFile"><td><code class="attributeName">truststoreFile</code></td><td>
		1329	<p>JSSE only.</p>
		1330	<p>The trust store file to use to validate client certificates. The
		1331	default is the value of the <code>javax.net.ssl.trustStore</code> system
		1332	property. If neither this attribute nor the default system property is
		1333	set, no trust store will be configured. Relative paths
		1334	will be resolved against <code>$CATALINA_BASE</code>. A URL may also be
		1335	used for this attribute.</p>
		1336	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_truststorePassword"><td><code class="attributeName">truststorePassword</code></td><td>
		1337	<p>JSSE only.</p>
		1338	<p>The password to access the trust store. The default is the value of the
		1339	<code>javax.net.ssl.trustStorePassword</code> system property. If that
		1340	property is null, no trust store password will be configured. If an
		1341	invalid trust store password is specified, a warning will be logged and an
		1342	attempt will be made to access the trust store without a password which
		1343	will skip validation of the trust store contents.</p>
		1344	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_truststoreProvider"><td><code class="attributeName">truststoreProvider</code></td><td>
		1345	<p>JSSE only.</p>
		1346	<p>The name of the truststore provider to be used for the server
		1347	certificate. The default is the value of the
		1348	<code>javax.net.ssl.trustStoreProvider</code> system property. If
		1349	that property is null and a single certificate has been configured for
		1350	this TLS virtual host then default will be the value of
		1351	<code>keystoreProvider</code> of the single certificate. If none of these
		1352	identify a default, the list of registered providers is traversed in
		1353	preference order and the first provider that supports the
		1354	<code>truststoreType</code> is used.
		1355	</p>
		1356	</td></tr><tr id="Special Features_SSL Support - SSLHostConfig_truststoreType"><td><code class="attributeName">truststoreType</code></td><td>
		1357	<p>JSSE only.</p>
		1358	<p>The type of key store used for the trust store. The default is the
		1359	value of the <code>javax.net.ssl.trustStoreType</code> system property. If
		1360	that property is null, a single certificate has been configured for this
		1361	TLS virtual host and that certificate has a <code>keystoreType</code> that
		1362	is not <code>PKCS12</code> then the default will be the
		1363	<code>keystoreType</code> of the single certificate. If none of these
		1364	identify a default, the default will be <code>JKS</code>. See the notes on
		1365	<a href="#Key_store_types">key store types</a> below.</p>
		1366	</td></tr></table>
		1367
		1368	</div></div>
		1369
		1370	<div class="subsection"><h4 id="SSL_Support_-_Certificate">SSL Support - Certificate</h4><div class="text">
		1371
		1372	<p></p>
		1373
		1374	<table class="defaultTable"><tr><th style="width: 15%;">
		1375	Attribute
		1376	</th><th style="width: 85%;">
		1377	Description
		1378	</th></tr><tr id="Special Features_SSL Support - Certificate_certificateFile"><td><code class="attributeName">certificateFile</code></td><td>
		1379	<p>Name of the file that contains the server certificate. The format is
		1380	PEM-encoded. Relative paths will be resolved against
		1381	<code>$CATALINA_BASE</code>.</p>
		1382	<p>In addition to the certificate, the file can also contain as optional
		1383	elements DH parameters and/or an EC curve name for ephemeral keys, as
		1384	generated by <code>openssl dhparam</code> and <code>openssl ecparam</code>,
		1385	respectively. The output of the respective OpenSSL command can simply
		1386	be concatenated to the certificate file.</p>
		1387	<p>This attribute is required unless
		1388	<strong>certificateKeystoreFile</strong> is specified.</p>
		1389	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateChainFile"><td><code class="attributeName">certificateChainFile</code></td><td>
		1390	<p>Name of the file that contains the certificate chain associated with
		1391	the server certificate used. The format is
		1392	PEM-encoded. Relative paths will be resolved against
		1393	<code>$CATALINA_BASE</code>.</p>
		1394	<p>The certificate chain used for Tomcat should not include the server
		1395	certificate as its first element.</p>
		1396	<p>Note that when using more than one certificate for different types,
		1397	they all must use the same certificate chain.</p>
		1398	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeyAlias"><td><code class="attributeName">certificateKeyAlias</code></td><td>
		1399	<p>JSSE only.</p>
		1400	<p>The alias used for the server key and certificate in the keystore. If
		1401	not specified, the first key read from the keystore will be used. The
		1402	order in which keys are read from the keystore is implementation
		1403	dependent. It may not be the case that keys are read from the keystore in
		1404	the same order as they were added. If more than one key is present in the
		1405	keystore it is strongly recommended that a keyAlias is configured to
		1406	ensure that the correct key is used.</p>
		1407	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeyFile"><td><code class="attributeName">certificateKeyFile</code></td><td>
		1408	<p>Name of the file that contains the server private key. The format is
		1409	PEM-encoded. The default value is the value of
		1410	<strong>certificateFile</strong> and in this case both certificate and
		1411	private key have to be in this file (NOT RECOMMENDED). Relative paths will
		1412	be resolved against <code>$CATALINA_BASE</code>.</p>
		1413	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeyPassword"><td><code class="attributeName">certificateKeyPassword</code></td><td>
		1414	<p>The password used to access the private key associated with the server
		1415	certificate from the specified file.</p>
		1416	<p>If not specified, the default behaviour for JSSE is to use the
		1417	<strong>certificateKeystorePassword</strong>. For OpenSSL the default
		1418	behaviour is not to use a password, but OpenSSL will prompt for one,
		1419	if required.</p>
		1420	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeyPasswordFile"><td><code class="attributeName">certificateKeyPasswordFile</code></td><td>
		1421	<p>The password file used to access the private key associated with the server
		1422	certificate from the specified file. This attribute takes precedence over
		1423	<strong>certificateKeyPassword</strong>.</p>
		1424	<p>If not specified, the default behaviour for JSSE is to use the
		1425	<strong>certificateKeystorePasswordFile</strong>. For OpenSSL the default
		1426	behaviour is not to use a password (file), but OpenSSL will prompt for one,
		1427	if required.</p>
		1428	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeystoreFile"><td><code class="attributeName">certificateKeystoreFile</code></td><td>
		1429	<p>JSSE only.</p>
		1430	<p>The pathname of the keystore file where you have stored the server
		1431	certificate and key to be loaded. By default, the pathname is the file
		1432	<code>.keystore</code> in the operating system home directory of the user
		1433	that is running Tomcat. If your <code>keystoreType</code> doesn't need a
		1434	file use <code>""</code> (empty string) or <code>NONE</code> for this
		1435	parameter. Relative paths will be resolved against
		1436	<code>$CATALINA_BASE</code>. A URI may also be used for this attribute.
		1437	When using a domain keystore (<code>keystoreType</code> of
		1438	<code>DKS</code>), this parameter should be the URI to the domain
		1439	keystore.</p>
		1440	<p>This attribute is required unless
		1441	<strong>certificateFile</strong> is specified.</p>
		1442	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeystorePassword"><td><code class="attributeName">certificateKeystorePassword</code></td><td>
		1443	<p>JSSE only.</p>
		1444	<p>The password to use to access the keystore containing the server's
		1445	private key and certificate. If not specified, a default of
		1446	<code>changeit</code> will be used.</p>
		1447	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeystorePasswordFile"><td><code class="attributeName">certificateKeystorePasswordFile</code></td><td>
		1448	<p>JSSE only.</p>
		1449	<p>The password file to use to access the keystore containing the server's
		1450	private key and certificate. This attribute takes precedence over
		1451	<strong>certificateKeystorePassword</strong>.</p>
		1452	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeystoreProvider"><td><code class="attributeName">certificateKeystoreProvider</code></td><td>
		1453	<p>JSSE only.</p>
		1454	<p>The name of the keystore provider to be used for the server
		1455	certificate. If not specified, the value of the system property
		1456	<code>javax.net.ssl.keyStoreProvider</code> is used. If neither this
		1457	attribute nor the system property are set, the list of registered
		1458	providers is traversed in preference order and the first provider that
		1459	supports the <code>keystoreType</code> is used.
		1460	</p>
		1461	</td></tr><tr id="Special Features_SSL Support - Certificate_certificateKeystoreType"><td><code class="attributeName">certificateKeystoreType</code></td><td>
		1462	<p>JSSE only.</p>
		1463	<p>The type of keystore file to be used for the server certificate.
		1464	If not specified, the value of the system property
		1465	<code>javax.net.ssl.keyStoreType</code> is used. If neither this attribute
		1466	nor the system property are set, a default value of "<code>JKS</code>". is
		1467	used. See the notes on <a href="#Key_store_types">key store types</a>
		1468	below.</p>
		1469	</td></tr><tr id="Special Features_SSL Support - Certificate_type"><td><code class="attributeName">type</code></td><td>
		1470	<p>The type of certificate. This is used to identify the ciphers that are
		1471	compatible with the certificate. It must be one of <code>UNDEFINED</code>,
		1472	<code>RSA</code>, <code>DSA</code>, <code>EC</code> or <code>MLDSA</code>.
		1473	If only one
		1474	<strong>Certificate</strong> is nested within a <code>SSLHostConfig</code>
		1475	then this attribute is not required and will default to
		1476	<code>UNDEFINED</code>. If multiple <strong>Certificate</strong>s are
		1477	nested within a <code>SSLHostConfig</code> then this attribute is required
		1478	and each <strong>Certificate</strong> must have a unique type.</p>
		1479	</td></tr></table>
		1480
		1481	</div></div>
		1482
		1483	<div class="subsection"><h4 id="SSL_Support_-_Connector_-_NIO_and_NIO2">SSL Support - Connector - NIO and NIO2</h4><div class="text">
		1484
		1485	<p>When APR/native is enabled, the connectors will default to using
		1486	OpenSSL through JSSE, which may be more optimized than the JSSE Java
		1487	implementation depending on the processor being used,
		1488	and can be complemented with many commercial accelerator components.</p>
		1489
		1490	<p>The following NIO and NIO2 SSL configuration attributes are not specific to
		1491	a virtual host and, therefore, must be configured on the connector.</p>
		1492
		1493	<table class="defaultTable"><tr><th style="width: 15%;">
		1494	Attribute
		1495	</th><th style="width: 85%;">
		1496	Description
		1497	</th></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2_sniParseLimit"><td><code class="attributeName">sniParseLimit</code></td><td>
		1498	<p>In order to implement SNI support, Tomcat has to parse the first TLS
		1499	message received on a new TLS connection (the client hello) to extract the
		1500	requested server name. The message needs to be buffered so it can then be
		1501	passed to the JSSE implementation for normal TLS processing. In theory,
		1502	this first message could be very large although in practice it is
		1503	typically a few hundred bytes. This attribute sets the maximum message
		1504	size that Tomcat will buffer. If a message exceeds this size, the
		1505	connection will be configured as if no server name was indicated by the
		1506	client. If not specified a default of <code>65536</code> (64k) will be
		1507	used.</p>
		1508	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2_sslImplementationName"><td><code class="attributeName">sslImplementationName</code></td><td>
		1509	<p>The class name of the SSL implementation to use. If not specified and
		1510	the tomcat-native library is not installed, the
		1511	default of <code>org.apache.tomcat.util.net.jsse.JSSEImplementation</code>
		1512	will be used which wraps JVM's default JSSE provider. Note that the
		1513	JVM can be configured to use a different JSSE provider as the default.
		1514	Tomcat also bundles a special SSL implementation for JSSE that is backed
		1515	by OpenSSL. To enable it, the native library should be enabled as if
		1516	intending to use the APR connector, and Tomcat will automatically enable it
		1517	and the default value of this attribute becomes
		1518	<code>org.apache.tomcat.util.net.openssl.OpenSSLImplementation</code>.
		1519	In that case, the attributes from either JSSE and OpenSSL
		1520	configuration styles can be used, as long as the two types are not mixed
		1521	(for example, it is not allowed to define use of a Java keystore and
		1522	specify a separate pem private key using the OpenSSL attribute).</p>
		1523	</td></tr></table>
		1524
		1525	</div></div>
		1526
		1527	<div class="subsection"><h4 id="SSL_Support_-_OpenSSL's_SSL_CONF_API">SSL Support - OpenSSL's SSL_CONF API</h4><div class="text">
		1528
		1529	<p>When OpenSSL is providing the TLS implementation, one or more
		1530	<strong>OpenSSLConfCmd</strong> elements may be nested inside a
		1531	<strong>OpenSSLConf</strong> element to configure OpenSSL via OpenSSL's
		1532	<code>SSL_CONF</code> API. A single <strong>OpenSSLConf</strong> element may
		1533	be nested in a <strong>SSLHostConfig</strong> element.</p>
		1534
		1535	<p>The set of configuration file commands available depends on the OpenSSL
		1536	version being used. For a list of supported command names and values, see the
		1537	section Supported configuration file commands in the <a href="https://www.openssl.org/docs/manmaster/man3/SSL_CONF_cmd.html#SUPPORTED-CONFIGURATION-FILE-COMMANDS">SSL_CONF_cmd(3)</a> manual page for OpenSSL. Some of the configuration file
		1538	commands can be used as alternatives to <strong>SSLHostConfig</strong>
		1539	attributes. It is recommended that configuration file commands are only used
		1540	where the feature cannot be configured using <strong>SSLHostConfig</strong>
		1541	attributes.</p>
		1542
		1543	<p>The <strong>OpenSSLConf</strong> element does not support any
		1544	attributes.</p>
		1545
		1546	<p>The <strong>OpenSSLConfCmd</strong> element supports the following
		1547	attributes.</p>
		1548
		1549	<table class="defaultTable"><tr><th style="width: 15%;">
		1550	Attribute
		1551	</th><th style="width: 85%;">
		1552	Description
		1553	</th></tr><tr id="Special Features_SSL Support - OpenSSL's SSL_CONF API_name"><td><strong><code class="attributeName">name</code></strong></td><td>
		1554	<p>The name of the configuration file command.</p>
		1555	</td></tr><tr id="Special Features_SSL Support - OpenSSL's SSL_CONF API_value"><td><code class="attributeName">value</code></td><td>
		1556	<p>The value to use for the configuration file command.</p>
		1557	</td></tr></table>
		1558
		1559	</div></div>
		1560
		1561	<div class="subsection"><h4 id="Key_store_types">Key store types</h4><div class="text">
		1562
		1563	<p>In addition to the standard key store types (JKS and PKCS12), most Java
		1564	runtimes support additional key store types such as Windows-ROOT,
		1565	Windows-My, DKS as well as hardware security modules. Generally, to use
		1566	these additional keystore types with a TLS Connector in Tomcat:</p>
		1567
		1568	<ul>
		1569	<li>Set the certificateKeystoreType and/or truststoreType Connector
		1570	attribute (as appropriate) to the necessary type</li>
		1571	<li>If a configuration file is required, set the certificateKeystoreFile
		1572	and/or truststoreFile Connector attribute (as appropriate) to point to
		1573	the file</li>
		1574	<li>If no configuration file is required then you will almost certainly
		1575	need to explicitly set the certificateKeystoreFile and/or
		1576	truststoreFile Connector attribute (as appropriate) to the empty
		1577	string ("")</li>
		1578	<li>If a password is required, set the certificateKeystorePassword and/or
		1579	truststorePassword Connector attribute (as appropriate) to the
		1580	required password</li>
		1581	<li>If no password is required then you will almost certainly need to
		1582	explicitly set the certificateKeystorePassword and/or
		1583	truststorePassword Connector attribute (as appropriate) to the empty
		1584	string ("")</li>
		1585	</ul>
		1586
		1587	<p>Variations in key store implementations, combined with the key store
		1588	manipulation Tomcat does in the background to allow interoperability between
		1589	JSSE and OpenSSL configuration styles, means that some keystores may need
		1590	slightly different configuration. Assistance is always available from the
		1591	<a href="http://tomcat.apache.org/lists.html#tomcat-users">Apache Tomcat
		1592	users mailing list</a>. We aim to document any key stores that vary from the
		1593	above advice here. Currently there are none we are aware of.</p>
		1594
		1595	</div></div>
		1596
		1597	<div class="subsection"><h4 id="SSL_Support_-_Connector_-_NIO_and_NIO2_(deprecated)">SSL Support - Connector - NIO and NIO2 (deprecated)</h4><div class="text">
		1598
		1599	<p>The following NIO and NIO2 SSL configuration attributes have been
		1600	deprecated in favor of the default
		1601	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1602	the <code>hostName</code> of <code>_default_</code>. If this
		1603	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1604	explicitly defined, it will be created..
		1605	</p>
		1606
		1607	<table class="defaultTable"><tr><th style="width: 15%;">
		1608	Attribute
		1609	</th><th style="width: 85%;">
		1610	Description
		1611	</th></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_algorithm"><td><code class="attributeName">algorithm</code></td><td>
		1612	<p>This is an alias for the <code>keyManagerAlgorithm</code> attribute of
		1613	the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1614	the <code>hostName</code> of <code>_default_</code>. If this
		1615	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1616	explicitly defined, it will be created.</p>
		1617	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_ciphers"><td><code class="attributeName">ciphers</code></td><td>
		1618	<p>This is an alias for the <code>ciphers</code> attribute of the
		1619	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with the
		1620	<code>hostName</code> of <code>_default_</code>. If this
		1621	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1622	explicitly defined, it will be created.</p>
		1623	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_clientAuth"><td><code class="attributeName">clientAuth</code></td><td>
		1624	<p>This is an alias for the <code>certificateVerification</code> attribute
		1625	of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element
		1626	with the <code>hostName</code> of <code>_default_</code>. If this
		1627	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1628	explicitly defined, it will be created.</p>
		1629	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_crlFile"><td><code class="attributeName">crlFile</code></td><td>
		1630	<p>This is an alias for the <code>certificateRevocationListFile</code>
		1631	attribute of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1632	element with the <code>hostName</code> of <code>_default_</code>. If this
		1633	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1634	explicitly defined, it will be created.</p>
		1635	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keyAlias"><td><code class="attributeName">keyAlias</code></td><td>
		1636	<p>This is an alias for the <code>certificateKeyAlias</code> attribute of
		1637	the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1638	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1639	element with the <code>hostName</code> of <code>_default_</code>. If this
		1640	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1641	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1642	explicitly defined, they will be created.</p>
		1643	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keyPass"><td><code class="attributeName">keyPass</code></td><td>
		1644	<p>This is an alias for the <code>certificateKeyPassword</code> attribute
		1645	of the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1646	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1647	element with the <code>hostName</code> of <code>_default_</code>. If this
		1648	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1649	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1650	explicitly defined, they will be created.</p>
		1651	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keystoreFile"><td><code class="attributeName">keystoreFile</code></td><td>
		1652	<p>This is an alias for the <code>certificateKeystoreFile</code> attribute
		1653	of the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1654	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1655	element with the <code>hostName</code> of <code>_default_</code>. If this
		1656	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1657	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1658	explicitly defined, they will be created.</p>
		1659	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keystorePass"><td><code class="attributeName">keystorePass</code></td><td>
		1660	<p>This is an alias for the <code>certificateKeystorePassword</code>
		1661	attribute of the first
		1662	<a href="#SSL_Support_-_Certificate">Certificate</a> element nested in the
		1663	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1664	element with the <code>hostName</code> of <code>_default_</code>. If this
		1665	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1666	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1667	explicitly defined, they will be created.</p>
		1668	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keystoreProvider"><td><code class="attributeName">keystoreProvider</code></td><td>
		1669	<p>This is an alias for the <code>certificateKeystoreProvider</code>
		1670	attribute of the first
		1671	<a href="#SSL_Support_-_Certificate">Certificate</a> element nested in the
		1672	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1673	element with the <code>hostName</code> of <code>_default_</code>. If this
		1674	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1675	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1676	explicitly defined, they will be created.</p>
		1677	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_keystoreType"><td><code class="attributeName">keystoreType</code></td><td>
		1678	<p>This is an alias for the <code>certificateKeystoreType</code> attribute
		1679	of the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1680	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1681	element with the <code>hostName</code> of <code>_default_</code>. If this
		1682	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1683	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1684	explicitly defined, they will be created.</p>
		1685	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_sessionCacheSize"><td><code class="attributeName">sessionCacheSize</code></td><td>
		1686	<p>This is an alias for the <code>sessionCacheSize</code> attribute of the
		1687	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1688	the <code>hostName</code> of <code>_default_</code>. If this
		1689	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1690	explicitly defined, it will be created.</p>
		1691	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_sessionTimeout"><td><code class="attributeName">sessionTimeout</code></td><td>
		1692	<p>This is an alias for the <code>sessionTimeout</code> attribute of the
		1693	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1694	the <code>hostName</code> of <code>_default_</code>. If this
		1695	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1696	explicitly defined, it will be created.</p>
		1697	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_sslEnabledProtocols"><td><code class="attributeName">sslEnabledProtocols</code></td><td>
		1698	<p>This is an alias for the <code>protocols</code> attribute of the
		1699	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1700	the <code>hostName</code> of <code>_default_</code>. If this
		1701	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1702	explicitly defined, it will be created.</p>
		1703	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_sslProtocol"><td><code class="attributeName">sslProtocol</code></td><td>
		1704	<p>This is an alias for the <code>sslProtocol</code> attribute of the
		1705	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1706	the <code>hostName</code> of <code>_default_</code>. If this
		1707	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1708	explicitly defined, it will be created.</p>
		1709	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_trustManagerClassName"><td><code class="attributeName">trustManagerClassName</code></td><td>
		1710	<p>This is an alias for the <code>trustManagerClassName</code> attribute
		1711	of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element
		1712	with the <code>hostName</code> of <code>_default_</code>. If this
		1713	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1714	explicitly defined, it will be created.</p>
		1715	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_trustMaxCertLength"><td><code class="attributeName">trustMaxCertLength</code></td><td>
		1716	<p>This is an alias for the <code>certificateVerificationDepth</code>
		1717	attribute of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1718	element with the <code>hostName</code> of <code>_default_</code>. If this
		1719	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1720	explicitly defined, it will be created.</p>
		1721	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_truststoreAlgorithm"><td><code class="attributeName">truststoreAlgorithm</code></td><td>
		1722	<p>This is an alias for the <code>truststoreAlgorithm</code> attribute of
		1723	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1724	the <code>hostName</code> of <code>_default_</code>. If this
		1725	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1726	explicitly defined, it will be created.</p>
		1727	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_truststoreFile"><td><code class="attributeName">truststoreFile</code></td><td>
		1728	<p>This is an alias for the <code>truststoreFile</code> attribute of
		1729	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1730	the <code>hostName</code> of <code>_default_</code>. If this
		1731	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1732	explicitly defined, it will be created.</p>
		1733	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_truststorePass"><td><code class="attributeName">truststorePass</code></td><td>
		1734	<p>This is an alias for the <code>truststorePassword</code> attribute of
		1735	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1736	the <code>hostName</code> of <code>_default_</code>. If this
		1737	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1738	explicitly defined, it will be created.</p>
		1739	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_truststoreProvider"><td><code class="attributeName">truststoreProvider</code></td><td>
		1740	<p>This is an alias for the <code>truststoreProvider</code> attribute of
		1741	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1742	the <code>hostName</code> of <code>_default_</code>. If this
		1743	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1744	explicitly defined, it will be created.</p>
		1745	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_truststoreType"><td><code class="attributeName">truststoreType</code></td><td>
		1746	<p>This is an alias for the <code>truststoreType</code> attribute of
		1747	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1748	the <code>hostName</code> of <code>_default_</code>. If this
		1749	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1750	explicitly defined, it will be created.</p>
		1751	</td></tr><tr id="Special Features_SSL Support - Connector - NIO and NIO2 (deprecated)_useServerCipherSuitesOrder"><td><code class="attributeName">useServerCipherSuitesOrder</code></td><td>
		1752	<p>This is an alias for the <code>honorCipherOrder</code> attribute of the
		1753	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1754	<code>hostName</code> of <code>_default_</code>. If this
		1755	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1756	explicitly defined, it will be created.</p>
		1757	</td></tr></table>
		1758
		1759	</div></div>
		1760
		1761	<div class="subsection"><h4 id="SSL_Support_-_Connector_-_APR/Native_(deprecated)">SSL Support - Connector - APR/Native (deprecated)</h4><div class="text">
		1762
		1763	<p>When APR/native is enabled, the HTTPS connector will use a socket poller
		1764	for keep-alive, increasing scalability of the server. It also uses OpenSSL,
		1765	which may be more optimized than JSSE depending on the processor being used,
		1766	and can be complemented with many commercial accelerator components. Unlike
		1767	the HTTP connector, the HTTPS connector cannot use sendfile to optimize static
		1768	file processing.</p>
		1769
		1770	<p>The HTTPS APR/native connector has the same attributes than the HTTP
		1771	APR/native connector, but adds OpenSSL specific ones. For the full details on
		1772	using OpenSSL, please refer to OpenSSL documentations and the many books
		1773	available for it (see the <a href="http://www.openssl.org">Official OpenSSL
		1774	website</a>). The SSL specific attributes for the APR/native connector are:
		1775	</p>
		1776
		1777	<table class="defaultTable"><tr><th style="width: 15%;">
		1778	Attribute
		1779	</th><th style="width: 85%;">
		1780	Description
		1781	</th></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCACertificateFile"><td><code class="attributeName">SSLCACertificateFile</code></td><td>
		1782	<p>This is an alias for the <code>caCertificateFile</code> attribute of
		1783	the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1784	the <code>hostName</code> of <code>_default_</code>. If this
		1785	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1786	explicitly defined, it will be created.</p>
		1787	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCACertificatePath"><td><code class="attributeName">SSLCACertificatePath</code></td><td>
		1788	<p>This is an alias for the <code>caCertificatePath</code> attribute of
		1789	the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1790	the <code>hostName</code> of <code>_default_</code>. If this
		1791	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1792	explicitly defined, it will be created.</p>
		1793	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCARevocationFile"><td><code class="attributeName">SSLCARevocationFile</code></td><td>
		1794	<p>This is an alias for the <code>certificateRevocationListFile</code>
		1795	attribute of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1796	element with the <code>hostName</code> of <code>_default_</code>. If this
		1797	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1798	explicitly defined, it will be created.</p>
		1799	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCARevocationPath"><td><code class="attributeName">SSLCARevocationPath</code></td><td>
		1800	<p>This is an alias for the <code>certificateRevocationListPath</code>
		1801	attribute of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1802	element with the <code>hostName</code> of <code>_default_</code>. If this
		1803	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1804	explicitly defined, it will be created.</p>
		1805	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCertificateFile"><td><strong><code class="attributeName">SSLCertificateFile</code></strong></td><td>
		1806	<p>This is an alias for the <code>certificateFile</code> attribute of the
		1807	first <a href="#SSL_Support_-_Certificate">Certificate</a> element nested
		1808	in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element
		1809	with the <code>hostName</code> of <code>_default_</code>. If this
		1810	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1811	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1812	explicitly defined, they will be created.</p>
		1813	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCertificateKeyFile"><td><code class="attributeName">SSLCertificateKeyFile</code></td><td>
		1814	<p>This is an alias for the <code>certificateKeyFile</code> attribute of
		1815	the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1816	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1817	element with the <code>hostName</code> of <code>_default_</code>. If this
		1818	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1819	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1820	explicitly defined, they will be created.</p>
		1821	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLCipherSuite"><td><code class="attributeName">SSLCipherSuite</code></td><td>
		1822	<p>This is an alias for the <code>ciphers</code> attribute of the
		1823	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with the
		1824	<code>hostName</code> of <code>_default_</code>. If this
		1825	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1826	explicitly defined, it will be created.</p>
		1827	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLDisableCompression"><td><code class="attributeName">SSLDisableCompression</code></td><td>
		1828	<p>This is an alias for the <code>disableCompression</code> attribute of
		1829	the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with
		1830	the <code>hostName</code> of <code>_default_</code>. If this
		1831	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1832	explicitly defined, it will be created.</p>
		1833	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLHonorCipherOrder"><td><code class="attributeName">SSLHonorCipherOrder</code></td><td>
		1834	<p>This is an alias for the <code>honorCipherOrder</code> attribute of the
		1835	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with the
		1836	<code>hostName</code> of <code>_default_</code>. If this
		1837	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1838	explicitly defined, it will be created.</p>
		1839	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLPassword"><td><code class="attributeName">SSLPassword</code></td><td>
		1840	<p>This is an alias for the <code>certificateKeyPassword</code> attribute
		1841	of the first <a href="#SSL_Support_-_Certificate">Certificate</a> element
		1842	nested in the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1843	element with the <code>hostName</code> of <code>_default_</code>. If this
		1844	<a href="#SSL_Support_-_Certificate">Certificate</a> and/or
		1845	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1846	explicitly defined, they will be created.</p>
		1847	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLProtocol"><td><code class="attributeName">SSLProtocol</code></td><td>
		1848	<p>This is an alias for the <code>protocols</code> attribute of the
		1849	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element with the
		1850	<code>hostName</code> of <code>_default_</code>. If this
		1851	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1852	explicitly defined, it will be created.</p>
		1853	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLVerifyClient"><td><code class="attributeName">SSLVerifyClient</code></td><td>
		1854	<p>This is an alias for the <code>certificateVerification</code> attribute
		1855	of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element
		1856	with the <code>hostName</code> of <code>_default_</code>. If this
		1857	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1858	explicitly defined, it will be created.</p>
		1859	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLVerifyDepth"><td><code class="attributeName">SSLVerifyDepth</code></td><td>
		1860	<p>This is an alias for the <code>certificateVerificationDepth</code>
		1861	attribute of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a>
		1862	element with the <code>hostName</code> of <code>_default_</code>. If this
		1863	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1864	explicitly defined, it will be created.</p>
		1865	</td></tr><tr id="Special Features_SSL Support - Connector - APR/Native (deprecated)_SSLDisableSessionTickets"><td><code class="attributeName">SSLDisableSessionTickets</code></td><td>
		1866	<p>This is an alias for the <code>disableSessionTickets</code> attribute
		1867	of the <a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element
		1868	with the <code>hostName</code> of <code>_default_</code>. If this
		1869	<a href="#SSL_Support_-_SSLHostConfig">SSLHostConfig</a> element is not
		1870	explicitly defined, it will be created.</p>
		1871	</td></tr></table>
		1872
		1873	</div></div>
		1874
		1875	<div class="subsection"><h4 id="Connector_Comparison">Connector Comparison</h4><div class="text">
		1876
		1877	<p>Below is a small chart that shows how the connectors differ.</p>
		1878
		1879	<table class="defaultTable" style="text-align: center;">
		1880	<tr>
		1881	<th></th>
		1882	<th style="text-align: center;">Java Nio Connector<br>NIO</th>
		1883	<th style="text-align: center;">Java Nio2 Connector<br>NIO2</th>
		1884	<th style="text-align: center;">APR/native Connector<br>APR</th>
		1885	</tr>
		1886	<tr>
		1887	<th>Classname</th>
		1888	<td><code class="noHighlight">Http11NioProtocol</code></td>
		1889	<td><code class="noHighlight">Http11Nio2Protocol</code></td>
		1890	<td><code class="noHighlight">Http11AprProtocol</code></td>
		1891	</tr>
		1892	<tr>
		1893	<th>Tomcat Version</th>
		1894	<td>since 6.0.x</td>
		1895	<td>since 8.0.x</td>
		1896	<td>since 5.5.x</td>
		1897	</tr>
		1898	<tr>
		1899	<th>Support Polling</th>
		1900	<td>YES</td>
		1901	<td>YES</td>
		1902	<td>YES</td>
		1903	</tr>
		1904	<tr>
		1905	<th>Polling Size</th>
		1906	<td><code class="noHighlight">maxConnections</code></td>
		1907	<td><code class="noHighlight">maxConnections</code></td>
		1908	<td><code class="noHighlight">maxConnections</code></td>
		1909	</tr>
		1910	<tr>
		1911	<th>Read Request Headers</th>
		1912	<td>Non Blocking</td>
		1913	<td>Non Blocking</td>
		1914	<td>Non Blocking</td>
		1915	</tr>
		1916	<tr>
		1917	<th>Read Request Body</th>
		1918	<td>Blocking</td>
		1919	<td>Blocking</td>
		1920	<td>Blocking</td>
		1921	</tr>
		1922	<tr>
		1923	<th>Write Response Headers and Body</th>
		1924	<td>Blocking</td>
		1925	<td>Blocking</td>
		1926	<td>Blocking</td>
		1927	</tr>
		1928	<tr>
		1929	<th>Wait for next Request</th>
		1930	<td>Non Blocking</td>
		1931	<td>Non Blocking</td>
		1932	<td>Non Blocking</td>
		1933	</tr>
		1934	<tr>
		1935	<th>SSL Support</th>
		1936	<td>Java SSL or OpenSSL</td>
		1937	<td>Java SSL or OpenSSL</td>
		1938	<td>OpenSSL</td>
		1939	</tr>
		1940	<tr>
		1941	<th>SSL Handshake</th>
		1942	<td>Non blocking</td>
		1943	<td>Non blocking</td>
		1944	<td>Blocking</td>
		1945	</tr>
		1946	<tr>
		1947	<th>Max Connections</th>
		1948	<td><code class="noHighlight">maxConnections</code></td>
		1949	<td><code class="noHighlight">maxConnections</code></td>
		1950	<td><code class="noHighlight">maxConnections</code></td>
		1951	</tr>
		1952	</table>
		1953
		1954	</div></div>
		1955	</div></div></div></div></div><footer><div id="footer">
		1956	Copyright © 1999-2025, The Apache Software Foundation
		1957	<br>
		1958	Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
		1959	are either registered trademarks or trademarks of the Apache Software
		1960	Foundation.
		1961	</div></footer></div></body></html>

Subversion Repositories Integrator Subversion

(root)/projeto-trade/apache-tomcat-9.0.112/webapps/docs/config/http.html - Rev 771