tomcat-reloading-connector is a ready to use solution for hot reloading certificates in Tomcat. You can just download the jar, plug it into your Tomcat (also works with embedded Tomcat and Spring Boot), configure it in
server.xml and it will reload the certs automatically shortly after the files change.
It's actually similar to the solutions provided by Sagar Zaveri and Mahesh.M. However, it's somewhat more sophisticated (watches the cert folder and reloads on change), you don't have to copy code, it's licensed liberally and offers documentation as well as examples 😉
BTW on top of
tomcat-reloading-connector, I built
letsencrypt-tomcat that queries and refreshes certs via Let's Encrypt at runtime.
You can read more about both
letsencrypt-tomcat in this blog post.
Note that for now,
tomcat-reloading-connector only works with Apache Portable Runtime (APR) based Native library for Tomcat, which uses certificates stored in PEM, not keystores. I'd recommend using APR anyways, as it provides much better performance as Tomcat's Java TLS implementation. With Docker APR is also rather easy to use, for example in thebitnami/tomcat image everything is preconfigured.
letsencrypt-tomcat also ships everything necessary for using APR.
If you're still interested in using a Keystore this this should be rather easy to implement. Try creating an issue in