The first problem is punching a hole in the firewall.  This was done easily enough by our network admin, however it had to be done a different port than normal as the default port was already being used.  Next, this port had to be configured in the Tomcat server.xml file.  One of the clear things I discovered whilst changing the port setting is that it is possible to have both HTTP and HTTPS access to TeamCity at the same time on different ports.  This meant we could keep the old internal HTTP port for local developers and set up the external port as HTTPS for our developers in the UK.

Setting up HTTPS meant creating a certificate for Tomcat.  It was easy enough to create a self signed certificate using the TeamCity documentation and the Tomcat documentation.  The Tomcat documentation also includes information about importing a third party signed certificate.

One thing to note about the self-signed certificate is that you can only import the certificate in Internet Explorer for future visits to the site if the value given to keytool for “What is your first and last name?” is the domain name used to access the site.  This one had me confused for a while.