David,

I am pretty sure you should be able to get the redirect working for the bundle that includes tomcat 3.2.x by following the instructions for configuring SSL that can be found at http://jakarta.apache.org/tomcat/index.html , you may also want to modify the jboss.properties to include the following:

java.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol

The following addresses your second question:

http://jakarta.apache.org/tomcat/tomcat-3.2-doc/tomcat-ssl-howto.html#s5

If you are using mod_jk, apache not tomcat will ensure that the connection is over ssl. Keep in mind that the security provided to the connection is outside the scope and control of the servlet container, although user-data-constraints should still be honored (by not allowing you to see the secured web app resource if you attempt to hit it over http.

HTH,

TC