Nginx + Tomcat 8 + let's encrypt + SSl not working
<p>i have some doubts and maybe you can help me.
I have an amazon EC2 instance running Nginx and Tomcat. I'm trying improve the security of aplications with let's encrypt. My doubts:</p>

<p>1 - Should I receive request's(http or https) at port 80 of Nginx and forward it to port 8080 of Tomcat?</p>

<p>2 - When getting let's encrypt certificates (with this command sudo ./certbot-auto certonly --agree-tos --webroot -w /opt/tomcat/webapps/ROOT -d mydomain.com) my webroot folder is the path of webapps or root path of a specific application?</p>

<p>3 - The folder .well-known/acme-challenge may be on webapps? root path of application? another place?</p>

<p>4 - Do i need change the permission of folders inside path /etc/letsencrypt/live/mydomain/key.pem?</p>

<p>5 - I have tried this config in a diferent situation. I have one domain in hostgator, i created a subdomain and pointed to ip of my amazon instance. In this case Nginx should be installed at hostgator server, or i can just forward the request from hostgator to Nginx in amazon instance?</p>

<p>I've tried diferent types of solution, but withous sucess. Nginx works fine with http protocol, but when i try to use https the page stays loading forever. Above is the scneario that i have at this moment. Thanks for the time and sorry for my english, i hope you can understand.   </p>

<p>Nginx conf:</p>

<pre><code>upstream tomcat_server {
    server 127.0.0.1:8080 fail_timeout=0;
}

server {
    listen 80;
    listen [::]:80;
    server_name  mydomain;
    return 301 https://$server_name$request_uri;
}

server {
    include /etc/nginx/conf.d/ssl-params.conf;
    location / {
        proxy_pass http://tomcat_server/;
    }
}
</code></pre>

<p>NGINX: ssl-params.conf</p>

<pre><code>ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
#ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
</code></pre>

<p>Tomcat server.xml</p>

<pre><code>                      ...
    &lt;Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" /&gt;
                      ...
</code></pre>