He should have skipped all the effort to enable SSL in Tomcat and put the certificate in his front-end webserver. Cause that's where it belongs.