Apache Tomcat

The NeverLapse agent on your Tomcat server (Linux or Windows) puts every new or renewed certificate on Tomcat's HTTPS connector: it writes a keystore, points server.xml at it, restarts Tomcat and checks the port, or puts everything back. Tested with Tomcat 9 and 10.1; Tomcat 8.5 and 11 use the same server.xml settings.

Setting it up

Make sure Tomcat already has an HTTPS connector, with any certificate (a self-signed one is fine, see below). NeverLapse changes the certificate of an existing connector; it doesn't add one.
Add a Linux - Apache Tomcat (agent, pull) or Windows - Apache Tomcat (agent, pull) host and pick its certificate. Under Apache Tomcat set the HTTPS connector port (the port of that connector in server.xml, default 8443). Leave server.xml and Service blank and the agent finds them; fill them in when the server has more than one Tomcat.
Save, reopen the host and install the agent on the Tomcat server with the install command at the top of the host's page. On Linux, Tomcat needs the native agent: x86_64, systemd and glibc 2.27 or newer.
At the next check-in the agent puts the certificate on Tomcat. The host's page shows the server.xml and service it uses, the certificate the port serves now and the last change step by step.

Where the agent looks when the fields are blank: on Linux /opt/tomcat/conf/server.xml, the Tomcat systemd unit's CATALINA_BASE, /etc/tomcat* and /opt/tomcat*, with the unit tomcat, tomcat9, tomcat10 or tomcat11; on Windows the Tomcat service (Tomcat9, Tomcat10, Tomcat11...) and its folder, or C:\Program Files\Apache Software Foundation\Tomcat *.

What happens on every new or renewed certificate

If the port already serves this certificate, nothing is changed or restarted.
The agent finds the <Connector> on the port. If there's none, more than one, or it isn't HTTPS, it says so on the host's page and changes nothing.
It backs up server.xml and the keystore it's about to replace (the last 10 are kept).
It writes the certificate, key and chain as a PKCS12 keystore with a new random password next to server.xml, in conf/neverlapse/. Only Tomcat's service account can read it (Linux: owned by the unit's user, mode 600; Windows: SYSTEM, Administrators and the Tomcat service's account).
It points the connector at the keystore: the default <SSLHostConfig><Certificate>, or the older keystoreFile/keystorePass attributes when the connector uses those (Tomcat 8.5 and 9). Only those attributes change; comments, layout and the other connectors stay as they are.
It restarts Tomcat and checks for up to 5 minutes that the port serves the new certificate.

If the restart or the check fails, the agent puts server.xml and the keystore back, restarts Tomcat again, shows the error on the host's page and tries the certificate again after 15 minutes. If Tomcat isn't running when a certificate arrives, the files are updated and Tomcat isn't started; it uses the new certificate when it next starts.

Tomcat restarts on every renewal, so its applications are unavailable while it starts.

An HTTPS connector to start from

If server.xml has no HTTPS connector yet, create a temporary self-signed keystore and add a connector inside <Service name="Catalina">, then restart Tomcat once:

keytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -dname CN=temporary -validity 30 -storetype PKCS12 -keystore conf/temporary.p12 -storepass changeit

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/temporary.p12" certificateKeystorePassword="changeit" type="RSA" />
    </SSLHostConfig>
</Connector>

Good to know

One certificate per Tomcat: the connector's default certificate. Extra <SSLHostConfig hostName="..."> entries keep their own.
A connector port written as a property (${https.port}) can't be matched; write the number in server.xml.
Works with a NeverLapse server on Windows, Linux or Docker.