Deploy a certificate to Tomcat

Octopus.TomcatDeployCertificate exported 2026-07-22 by Octopus Deploy belongs to ‘Certificate’ category.

Deploy a certificate to Tomcat 7+ by configuring the server.xml file.

Parameters

When this step is included in a project’s deployment process, the parameters below can be set.

Tomcat CATALINA_HOME path

Tomcat.Certificate.CatalinaHome (required)

The root directory of the binary distribution of Tomcat.

Tomcat CATALINA_BASE path

Tomcat.Certificate.CatalinaBase

The root directory of the active configuration of Tomcat. Leave blank if CATALINA_HOME and CATALINA_BASE directories are the same.

Certificate variable

Java.Certificate.Variable (required)

The certificate variable to deploy.

Tomcat service name

Tomcat.Certificate.Service

The name of the Service element in the server.xml file.

Default: Catalina

Example: Catalina

SSL implementation

Tomcat.Certificate.Implementation

The standard SSL implementation provided by Tomcat to support HTTPS. Not all versions of Tomcat support all implementations.

Allowed values: BIO, NIO, NIO2, APR

Default: NIO

HTTPS port

Tomcat.Certificate.Port

The HTTPS port that this certificate will be bound to.

Example: 8443

Certificate SNI hostname

Tomcat.Certificate.Hostname

In Tomcat 8.5 and above, certificates can be bound to a host name using SNI. Leave blank when deploying to Tomcat 7 or 8.

Default certificate

Tomcat.Certificate.Default

In Tomcat 8.5 and above, a certificate can be designated as the default one to respond to any request to a host that does not have a specific certificate assigned. This field has no effect when deploying to Tomcat 7 or 8.

Allowed values: True, False

Default: False

Private key password

Java.Certificate.Password

An optional password assigned to the private key. If left blank, the default password defined by Tomcat will be used where possible, or the private key will remain unencrypted.

Private key filename

Tomcat.Certificate.PrivateKeyFilename

The optional path of the private key file generated when configuring the APR implementation. If left blank, a new file will be created in the Tomcat conf directory.

Public key filename

Tomcat.Certificate.PublicKeyFilename

The optional path of the public key file generated when configuring the APR implementation. If left blank, a new file will be created in the Tomcat conf directory.

Keystore filename

Java.Certificate.KeystoreFilename

The optional path of the keystore generated when configuring the BIO, NIO, and NIO2 implementations. If left blank, a keystore file will be created in the Tomcat conf directory. If the file exists, it will be overwritten.

Keystore alias

Java.Certificate.KeystoreAlias

The optional alias under which the certificate information will be stored when configuring the BIO, NIO, and NIO2 implementations. If left blank, the default alias of ‘octopus’ will be used.

Step configuration using OCL

Example in Octopus Configuration Language (OCL):

step "deploy-cert-to-tomcat" {
    name = "Deploy cert to Tomcat"
    properties = {
        Octopus.Action.TargetRoles = "tomcat-server"
    }

    action {
        action_type = "Octopus.TomcatDeployCertificate"
        properties = {
            Java.Certificate.KeystoreAlias = "tomcat"
            Java.Certificate.KeystoreFilename = "/opt/tomcat/conf/keystore.jks"
            Java.Certificate.Variable = "Certificates-MyCert"
            Octopus.Action.RunOnServer = "false"
            Tomcat.Certificate.CatalinaHome = "/opt/tomcat"
            Tomcat.Certificate.Implementation = "NIO"
            Tomcat.Certificate.Port = "8443"
            Tomcat.Certificate.Service = "Catalina"
        }
    }
}

Page updated on Wednesday, July 22, 2026