How to secure a Websocket. Apache Vhost or ServerEndpointConfig

Question

I have a Tomcat9 webserver hosted via Apache2-Vhost.

How do I secure a websocket running on tomcat?

1. Is it over a Apache Vhost certificat from letsencrypt/certbot?
2. Is it in the javax.websocket.server.ServerEndpointConfig.Configurator of the Tomcat's Websocket class?

@Override
public void modifyHandshake(ServerEndpointConfig config, HandshakeRequest request, HandshakeResponse response) {

  SSLContext csslContext = SSLContext.getInstance("TLS");

  config.getUserProperties().put(Constants.SSL_CONTEXT_PROPERTY, csslContext);
  config.getUserProperties().put(Constants.SSL_PROTOCOLS_PROPERTY, csslContext);
}

Answer 1

A Websocket connection is always started via an HTTP(S) request, upgraded to Websocket. So securing the connection between the client and the web server (or reverse proxy) is exactly the same as securing a "regular" HTTP connection.

You should never need to write any code for this, so your example #1 in your question where you are modifying the handshake isn't anything you need to consider.

You should be looking at something like #1 where you get a certificate from a Certificate Authority (CA) and install it into the reverse-proxy (httpd).