<p>I'm trying to create a self signed certificate for use with Apache Tomcat 6.  Every certificate I can make always results in the browser connecting with AES-128.  The customer would like me to demonstrate that I can create a connection at AES-256.</p>

<p>I've tried java's keytool and openssl.  I've tried with a variety of parameters, but can't seem to specify anything about the keysize, just the signature size.</p>

<p>How can I get the browser-tomcat connection to use AES-256 with a self signed certificate?</p>

danivo, so long as the server's cert is capable of AES encryption, the level of encryption between the browser and the server is independent of the cert itself -- that level of encryption is negotiated between the browser and server.  In other words, my understanding is that the cert doesn't specify the level of encryption, just the
type
of encryption (e.g., AES).  See
this link
(PDF) for verification of this, and how the cert resellers upsell "256-bit-capable" certs despite the cert not being what determines 256-bit capability.
So you're just fine with the cert you have that supports AES-128 -- and they key is to figure out how to get Tomcat to support AES-256 (since most, if not all, major browsers certainly support it).