---
title: "How to configure Tomcat"
slug: "how-to-configure-tomcat"
updated: 2026-11-06T15:23:57Z
published: 2026-11-06T15:23:57Z
canonical: "docs.senhasegura.io/how-to-configure-tomcat"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt
> Use this file to discover all available pages before exploring further.

# How to configure Tomcat

This document provides information on how to configure the Tomcat publishing profile to make it possible to install and publish certificates.

## Requirements

The Tomcat service on the server must be named `tomcat`. Segura® restarts Tomcat with `systemctl stop tomcat` and `systemctl start tomcat`, or with the `service tomcat` command, and the service name is fixed.

## Publishing modes

Segura® publishes the certificate in one of two modes, depending on the fields you fill in:

- **Keystore:** if you fill in the **Keystore name**, **Alias certificate**, and **Password keystore** fields, Segura® publishes the certificate directly to the keystore and ignores the `server.xml` file.
- **server.xml:** if any of those fields is empty, the **Configuration file path (server.xml)** field is required.

## Configure Tomcat

To configure Tomcat, see the following steps:

1. On Segura™, in the navigation bar, hover over the **Products** menu and select **Certificate Manager**.
2. In the side menu, select **Publishing > Publishing profiles**.
3. In the actions button, select **Tomcat**.
4. In the **Settings** tab, enter the following information:
  1. In the **Profile name ***, enter the profile's name.
  2. In the **Credential username**, enter the credentials' name.
  3. (Optional): Check the **Use a registered credential to access all devices** option and, in the **Access credential registered in the system**, select the access credential registered in Segura™ to be used.
5. Click **Continue**.
6. In the **Tomcat** tab, enter the following fields:
  1. In the **Keystore name** field, enter the full path of the keystore. For example: `/opt/tomcat9/keystore.jks`. If the keystore does not exist, it is created automatically.
  2. In the **Alias certificate** field, enter the certificate alias. If the alias does not exist, it is created automatically.
  3. In the **Password keystore** field, select the credential that has the keystore password. The credential needs to be previously created in Segura™.
  4. Optional: In the **Way of the intermediate certificate** field, enter the path of the intermediate certificate.
  5. In the **Configuration file path (server.xml)** field, enter the path of the configuration file.
  6. In the **Tomcat version** field, select the Tomcat version.
  7. Optional: In the **Port** field, enter the port Segura® uses to check the server after publication. Enter digits only, from 1 to 65535. If you leave the field empty, Segura® skips the check. See [Post-publication check](/v4-2/docs/how-to-configure-tomcat#postpublication-check).
7. Click **Continue**.
8. In the **Devices** tab, select the Tomcat server.
  1. The device must be previously registered in Segura™.
  2. The **Devices** and **Review** tabs include a read-only **Network Connector** column that shows **Yes** or **No**, depending on whether the device has its own Network Connector configured.
9. In the **Review** tab, review all information entered previously, and click **Save**.

## Post-publication check

If you entered a port in the **Port** field, Segura® connects to the server on that port after installing the certificate and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate. If the server does not respond, Segura® retries after 5, 10, 15, 15, 15, and 15 seconds.

- If the fingerprints match, the publication succeeds.
- If the fingerprints differ, the publication fails.
- If the server does not respond after all retries, the publication still ends successfully, and the execution log records a warning.

If you left the **Port** field empty, the execution log records `TLS verification skipped: no port configured`.

The execution details do not display the keystore password.

## Network Connector behavior

Tomcat publishing uses the device's Network Connector for both the installation and the post-publication check. Through a Network Connector, the check connects without SNI.

Attention

If Tomcat serves several SSL hosts on the same port, the check through a Network Connector can reach a host other than the one with the new certificate, and the publication fails even though the new certificate is in use.