Step 2: Install Tomcat

Apache Tomcat is the web application server that runs Jamf Pro.

Jamf tests each version of Jamf Pro with the corresponding version of Tomcat listed in the Apache Tomcat Versions Installed by the Jamf Pro Installer article. You are highly encouraged to install the version of Tomcat associated with the version of Jamf Pro you are installing.

The following instructions explain how to manually configure Tomcat to use a self-signed SSL certificate on port 8443.

1. In a web browser, open the Tomcat 8 download page:
   https://tomcat.apache.org/download-80.cgi

2. If you need the latest version of Tomcat:

   1. On the Tomcat 8 download page, navigate to Tomcat 8.5.x > Binary Distributions > Core.

   2. Click the "32-bit/64-bit Windows Service Installer" link to download the installer.

3. If you need a previous version of Tomcat:

   1. On the Tomcat 8 download page, navigate to the Quick Navigation section and click Archives.

   2. Click the folder for the version of Tomcat that you want.

   3. Click the bin/ folder.

   4. Click the "apache-tomcat-8.5.x.exe" link to download the installer.

4. Launch the Apache Tomcat 8.5.x Windows Service Installer.

5. Follow the onscreen instructions, and choose "Minimum" from the Select the type of install pop-up menu.

6. Expand the option for Tomcat and select the Service Startup option to customize the install.

   Note: Selecting the Service Startup option automatically starts Tomcat when the computer starts.

7. Click Next and use the default settings to configure the rest of the installation.

Step 3: Install the Jamf Pro Server Tools CLI

1. Download the Jamf Pro Server Tools CLI. For instructions, see the following article:
   The Jamf Pro Server Tools Command-Line Interface

2. Open Command Prompt.

3. Configure the Tomcat directory by executing a command similar to the following:

   jamf-pro config set --tomcat-dir "C:\Program Files\Apache Software Foundation\Tomcat 8.5"

4. Configure the Tomcat service by executing a command similar to the following:

   jamf-pro config set --tomcat-service Tomcat8

It is highly recommended that you regularly create backups as you work toward a fully configured and operational Jamf Pro. For instructions, see Backing Up the Database.

Step 4: Allocate Additional Memory to Tomcat

You can allocate additional memory to Tomcat by using one of the following methods:

• Method 1: Allocating Additional Memory to Tomcat Using the Jamf Pro Server Tools CLI

1. Open Command Prompt.

2. Set the minimum Tomcat memory by executing the following command:

   jamf-pro server config set --min-memory 256M

3. Set the maximum Tomcat memory by executing the following command:

   jamf-pro server config set --max-memory 512M

• Method 2: Manually Allocating Additional Memory to Tomcat
  
  The default Java Maximum Memory Pool for Tomcat on Windows is set to 256 MB. This should be increased to at least 512 MB. To accommodate a large number of computers in Jamf Pro, you will have to allocate additional Java Virtual Machine (JVM) memory to Tomcat. If other services are running on your server, make sure to leave enough memory to accommodate them.

1. Open the Tomcat8w.exe application found in the "C:\Program Files\Apache Software Foundation\Tomcat 8.5\bin" path.

2. Click the Java tab.

3. Enter the amount of memory you want to allocate in the Maximum Memory Pool field.

4. Click Apply.

5. Open Command Prompt and start Tomcat by executing:

   net start Tomcat8

   The Tomcat service should be running and will automatically unpack the ROOT.war file into a ROOT directory in the webapps directory.

Step 5: Create the Jamf Pro Database

A MySQL database must be created before you can install Jamf Pro.

You can create the Jamf Pro database using one of the following methods:

• Method 1: Creating the Jamf Pro Database Using the Jamf Pro Server Tools CLI
  Follow the instructions in the Creating the Jamf Pro Database Using the Jamf Pro Server Tools Command-Line Interface article.

• Method 2: Manually Creating the Jamf Pro Database
  Follow the instructions in the Manually Creating the Jamf Pro Database article.

Step 6: Install Jamf Pro

1. (Optional) Create a C:\temp\jamf directory in which to temporarily store downloads, tools, and scripts for Jamf Pro by executing:

   mkdir C:\temp\jamf

2. (Optional) Copy the ROOT.war file from the Jamf Pro manual download archive to the C:\temp\jamf directory that you just created.

3. Open Command Prompt.

4. Stop Tomcat by executing:

   net stop Tomcat8

5. Rename the ROOT web app directory to something like TOMCAT in Windows Explorer or at the Command Prompt by executing a command similar to the following:

   move "C:\Program Files\Apache Software Foundation\Tomcat 8.5\
     webapps\ROOT" "C:\Program Files\Apache Software Foundation\
     Tomcat 8.5\webapps\TOMCAT"

6. Copy the Jamf Pro ROOT.war web app to the Tomcat webapps directory in Explorer or at the Command Prompt by executing a command similar to the following:

   copy C:\temp\jamf\ROOT.war "C:\Program Files\Apache
     Software Foundation\Tomcat 8.5\webapps\"

7. Generate a keystore to enable SSL for Tomcat by executing a command similar to the following:

   "C:\Program Files\Amazon Corretto\jdk11.0.3_7\bin\keytool.exe" -genkey -alias tomcat -keyalg RSA -keypass "changeit" -storepass "changeit" -dname "CN=jamf.mycompany.com, OU=Jamf IT, O=Jamf, L=Minneapolis, ST=MN, C=US" -keystore "C:\Program Files\Apache Software Foundation\Tomcat 8.5\keystore" -validity <numdays>

   Make sure to change the following attributes as appropriate to your site:

   Attribute	Value	Example
   CN=	Fully qualified domain name of the server	jamf.mycompany.com
   OU=	Organizational unit	Jamf IT
   O=	Organization	Jamf
   L=	Location (city or office)	Minneapolis
   ST=	State, province, or county	MN
   C=	Country or region	US

8. Back up the Tomcat server.xml configuration file by executing a command similar to the following:

   copy "C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\server.xml" "C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\server.xml.bak"

9. Open the server.xml configuration file.

   Note: You can do this with Wordpad, as long as the file is saved as a plain text document named server.xml.

10. Locate the following comment section in the file (note that this is the Connector on port 8443 not the Connector on port 8443 with HTTP/2 section):

    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
            This connector uses the NIO implementation.
            ...
    -->

11. Replace the commented out (initial <!-- and trailing -->) Connector tag immediately following the comment (shown in "a" below) with the Connector tag text shown in "b" below:
    a.

    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
         ...
    -->
    <!--
    <Connector port="8443" ...
      ...
    />
    -->

    b.

    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
               This connector uses the NIO implementation that requires the
               JSSE style configuration. When using the APR/native
               implementation, the OpenSSL style configuration is required
               as described in the APR/native documentation -->
    <Connector URIEncoding="UTF-8"
               server="Apache Tomcat"
               port="8443"
               executor="tomcatThreadPool"
               SSLEnabled="true"
               maxPostSize="-1"
               scheme="https"
               protocol="org.apache.coyote.http11.Http11Nio2Protocol"
               sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
               secure="true">
      <SSLHostConfig sslProtocol="TLS"
                     protocols="TLSv1.2"
                     honorCipherOrder="true"
                     certificateVerification="none"
                     ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
                              TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
                              TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
                              TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
                              TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
                              TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                              TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
                              TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
                              TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
                              TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
                              TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
                              TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
                              TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
                              TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
                              TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
                              TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
                              TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
                              TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
                              TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
                              TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
                              TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
                              TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
                              TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
                              TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" >
        <Certificate type="RSA"
                     certificateKeystoreFile="C:\Program Files\Apache Software Foundation\Tomcat 8.5\keystore"
                     certificateKeystorePassword="changeit" />
      </SSLHostConfig>
    </Connector>

12. Go back to Command Prompt, and add a rule to the firewall configuration to allow access to port 8443 by executing:

    netsh advfirewall firewall add rule name=Jamf_Secure dir=in
      action=allow protocol=TCP localport=8443

13. Open the log4j2.xml file and change all of the log file paths from the following:

    fileName="/Library/JSS/Logs/[filename].log"
    filePattern="/Library/JSS/Logs/[filename].log.%i">

    to:

    fileName="C:\Program Files\JSS\logs\[filename].log"
    filePattern=" C:\Program Files\JSS\logs\[filename].log.%i">

14. Start Tomcat by executing the following command:

    net start Tomcat8

Step 7: (Optional) Disable TLS 1.0 and 1.1 in Java 11

If you are using the TLS 1.0 or 1.1 protocols in Java 11 for any existing workflows, it is recommended that you disable them since they are deprecated. For instructions, see the following article: Disabling TLS 1.0 and 1.1 in Java 11.

Step 8: Connect to the Jamf Pro Server

1. Configure the database connection settings using Jamf Pro Server Tools GUI or CLI. For instructions, see the Editing the Database Connection Using Jamf Pro Server Tools article.

2. Access Jamf Pro by opening a web browser and typing the protocol, IP address or hostname of the server, and port. For example: https://jamf.mycompany.com:8443/

   Note: Some web browsers may initially prevent access to Jamf Pro on port 8443 and may produce an "invalid certificate" error. If this error occurs, do the following:

   1. Enter your Jamf Pro server URL in the web browser's address bar using "http" and port 8080 (e.g., "http://jamf.mycompany.com:8080").

   2. When prompted by the Jamf Pro setup assistant for the Jamf Pro URL, enter your Jamf Pro server URL using "https" and port 8443 (e.g., https://jamf.mycompany.com:8443).

   You can begin using your Jamf Pro server URL to access Jamf Pro after you have uploaded a valid certificate and restarted Tomcat. For more information, see SSL Certificate in the Jamf Pro Administrator's Guide.

Step 9: Secure Your Jamf Pro Server

Secure your Jamf Pro server by following the recommendations in the Jamf Pro Security Recommendations article.