In the past, I've found making tomcat listen on unprivileged 8080 and proxying it using nginx on 443 works well.