With Nginx, a renewed certificate is two PEM files and a reload. Tomcat and Spring Boot usually load a keystore instead ( .jks or .p12 ), so each renewal also means downloading the Tomcat-format certificate from your CA or cloud console, or running openssl pkcs12 or keytool to build a keystore yourself, then replacing the old file and restarting the app. That's fine once a year. Public certificates issued today are already capped at 200 days, the cap drops to 100 days on March 15, 2027, and to 47 days on March 15, 2029. At that point you are doing it roughly every month.

This post covers how to automate renewal for Java apps: first check whether the app loads the certificate at all, then the Tomcat and Spring Boot settings that matter, the three errors that most often break a certificate swap, and two ways to automate the whole thing: a Certbot hook you maintain yourself, or LapseZero as a hosted service.

Check where HTTPS terminates

Many Java apps sit behind Nginx, HAProxy or a cloud load balancer that…