Tomcat SSL: https://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html

../tomee/conf/web.xml

<security-constraint>
 <web-resource-collection>
     <web-resource-name>Protected Context</web-resource-name>
     <url-pattern>/*</url-pattern>
 </web-resource-collection>

 <!-- auth-constraint goes here if you requre authentication -->
 <user-data-constraint>
     <transport-guarantee>CONFIDENTIAL</transport-guarantee>
 </user-data-constraint>
</security-constraint>

../tomee/conf/server.xml

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     certificateKeystorePassword="xxx"
                     certificateKeyPassword="yyy"
                     type="RSA" xpoweredBy="false" server="Apache TomEE" />
    </SSLHostConfig>
</Connector>

see docu

keytool -list -v -keystore keystore.jks
keytool -delete -alias tomcat
keytool -genkey -alias tomcat -keyalg RSA -keystore /markus/tomee/conf/localhost-rsa.jks -keysize 2048

Note: default keystore is in user's home folder under ".keystore", password=changeit