Apache Tomcat Integration Guide

Overview

CertSecure Manager automates SSL/TLS renewal for Apache Tomcat servers through the agentless Renewal Manager, a Windows service that works alongside CertSecure Manager.

Configuration Steps

Step 1: Deploy the Renewal Manager Service

  • Provision a Windows Server (2016 or later) that will run the Renewal Manager as a Windows service.
  • In CertSecure Manager, go to Utilities → Integrations → Renewal Manager.
  • Click the Apache Tomcat application icon, then click Download to obtain the Renewal Manager installer.
  • On the same page, generate the Registration Token required during service installation.
  • Install and start the Renewal Manager Windows service, supplying the registration token when prompted.

Step 2: Prepare the Apache Tomcat Endpoint

  • Ensure the Renewal Manager host can make outbound connections to each Apache Tomcat endpoint on its TLS port. The service uses this for both the expiry-check handshake and certificate deployment.
  • Confirm firewalls, security groups, and network segmentation allow that traffic; unreachable endpoints show as “failed to check expiry” in the renewal report.
  • For each endpoint, note the certificate file path and private key path on the server (PEM format expected).

Note: Certificate/key paths are not required for IIS endpoints. For Apache Tomcat deployments that use a Java keystore rather than PEM files, confirm the expected path handling against your environment.

Step 3: Add the Apache Tomcat Server in CertSecure Manager

  • In Utilities → Integrations → Renewal Manager, select the Apache Tomcat application type.
  • Click Add Server and provide the server details:
    • Certificate Authority: the CA the certificates should be issued from
    • Template: the certificate template
    • Owner: the certificate owner
    • Endpoint IP or Hostname: the endpoint address (one is required)
    • Port: the TLS port the endpoint serves on
    • Certificate Path: file path to the PEM certificate on the endpoint
    • Key Path: file path to the PEM private key on the endpoint
  • Save the server entry. Repeat for each Apache Tomcat endpoint.

Step 4: Renew and Automate

  • Manually renew by right-clicking the server/endpoint and selecting Renew, or use Schedule Renewal.
  • To fully automate, enable the Automation Status toggle so the Renewal Manager renews and redeploys on schedule.