- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
Tomcat
Works the same way as Apache: certificate and key files on disk, then a service restart.
Supported operating system(s): Windows or Linux.
Adding a Tomcat Server
- On the Renewal Manager tab, click Add Server (or click the Tomcat tile in the connector grid).
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Server Name | Required, Add only | A unique display name for this server. Cannot be changed later. Maximum 50 characters. |
| Operating System | Required | Windows or Linux, matching the target server. |
| Server IP | Required | The IPv4 address CertSecure uses to reach this server. |
| Server Username | Required | A WinRM account (Windows) or SSH account (Linux) used to connect to this server. |
| Server Password | Required | The password for Server Username. Stored encrypted. On Edit, leave blank to keep the existing password. |
| Service Name | Required | The OS service to restart, for example Tomcat9 on Windows or tomcat9 on Linux. |
Tomcat Server List Actions
Right-click a server row (or open its actions menu) to see:
- View Details – opens a read-only summary of the server's configuration.
- Edit Details – reopens the Add Server form pre-filled, so you can update credentials or service name.
- Manage Endpoints – opens the endpoint list for this server.
- Push Certificate – issues a new certificate and saves it and its key in the directories you enter, without replacing existing files or restarting the service. See Pushing a Certificate.
- View Tasks – opens the task history for this server.
- Delete – deletes the server after a confirmation prompt. Deleting a server also removes every endpoint added under it.
Adding a Tomcat Endpoint
- From the server list, open Manage Endpoints on the server (right-click → Manage Endpoints).
- Click Add Endpoint.
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Certificate Authority | Required | The CA that will issue renewed certificates for this endpoint. |
| Template | Required | The certificate template/profile to request from the selected CA. Options depend on the CA chosen. |
| Address Type | Required | Whether you will identify this endpoint by IP Address or by Hostname. |
| IP Address / Hostname | Required | The exact address of the TLS service to watch. |
| Port | Required | The TCP port the TLS service listens on, for example 443. |
| Certificate Source | Required | Where the certificate is kept: Certificate files on disk, or a JKS or PKCS12 keystore. |
| Certificate Path | Required for Certificate files on disk | Full file path where the certificate should be deployed. |
| Key Path | Required for Certificate files on disk | Full file path where the private key lives. |
| Keystore Path | Required for JKS / PKCS12 | Full path to the keystore file on the server. Maximum 500 characters. |
| Keystore Alias | Required for JKS / PKCS12 | The alias of the certificate entry inside the keystore. Maximum 255 characters. |
| Keystore Password | Required for JKS / PKCS12 | The password of the keystore. Stored encrypted. On Edit, leave blank to keep the existing password. |
| Key Password | Optional, JKS only | Only needed if the key uses a different password from the keystore. On Edit, leave blank to keep the existing password. |
| Owner | Required | The person responsible for this endpoint. Select an organization user from the list. |
| Organization ID | Only when CA = DigiCert | The DigiCert organization ID to request the certificate under. |
| Order Validity | Only when CA = DigiCert | How many days the requested certificate should be valid for. |
Endpoint Actions
From the endpoint list, use the row actions (right-click or the actions menu) to:
- View Details – opens a read-only summary of the endpoint.
- Edit Details – reopens the Add Endpoint form pre-filled, so you can change the certificate settings (Certificate Authority, Template, Owner) and the other endpoint details. The address type, IP address / hostname and port cannot be changed; delete the endpoint and add it again to change them.
- Renew – opens the Renew Endpoint dialog. Available only while automation is disabled for the endpoint.
- Delete – removes this endpoint from the server. It does not affect other endpoints on the same server.
- Change Request – creates a ServiceNow change request for this endpoint. See ServiceNow Change Requests.
Renewing a Tomcat Certificate
- Open Manage Endpoints on the server, find the endpoint, right click and choose Renew.
-
Pick one of:
- Renew Now – queues the renewal immediately.
- Schedule Renewal – pick a date and time at least 30 minutes from now using Enter Schedule Time.
- Click Renew (or Schedule if you chose to schedule it).
Before you can renew manually:
- The Renewal Manager Agent must be Online.
- Automation must be disabled for that endpoint (see Automatic Renewal). While automation is enabled for an endpoint, its Renew option is unavailable.
- The endpoint must already exist under the server. Add it first if it does not.
What Happens When You Renew
- The agent generates a new key and certificate request with OpenSSL on the target server.
- It submits the request to the CA and receives the new certificate.
- It replaces the existing certificate and key files with the new ones in place.
- If the endpoint's Certificate Source is a JKS or PKCS12 keystore, the new certificate is imported into that keystore under the configured alias instead (the keystore is backed up first).
- It restarts the Tomcat service using the Service Name you configured.
Viewing Tasks
Here’s how to check renewal progress:
- Right-click a server → View Tasks.
- Use Search Keyword, the column filters, or Refresh to find a specific task.
Task Columns
| Column | What it shows |
|---|---|
| Info | A colored status badge: OK, ERROR, PROCESSING, PENDING, INITIALIZED, or WARNING. |
| Task ID | The unique ID of this task. |
| Updated On | When the task status last changed. Filterable by date. |
| Task Name | What kind of task this is, for example a renewal or a scheduled TLS scan. |
| Details | A short description of the current status or the last error. |
| IP Address | The endpoint address(es) involved. |
| Status | The current status text. |
Task Status Meanings
- INITIALIZED – the task was just created and is queued.
- PENDING – waiting for the agent to pick it up.
- PROCESSING – the agent is actively working on it.
- OK – completed successfully.
- WARNING – completed, but with something worth checking.
- ERROR – failed. Check Details for the reason.
Before You Start
- Two endpoints on the same server that use the exact same Certificate Path are renewed together in a single cycle.
- openssl must be on the server's PATH.
- keytool must be available on the server when a keystore is used.