+49 (0) 30 5201 4923
info@orb-experts.com
Learn how to install, configure, secure, monitor and operate Apache Tomcat 11 as a production platform for Jakarta EE web applications. This three-day course covers Tomcat architecture, Java runtime requirements, application deployment, server configuration, security, performance, high availability and containerised operation. Participants learn how to administer applications based on Jakarta Servlet, Jakarta Pages and Jakarta WebSocket. They configure server and application resources, implement TLS and access controls, monitor runtime behaviour and prepare Tomcat environments for reverse proxies, load balancing and clustering. The course also addresses migration from Tomcat 9 and Java EE applications to the Jakarta EE namespace used by Tomcat 10 and 11. It explains how modern process isolation, operating-system controls and container security can replace obsolete Security Manager-based configurations.
You will learn how to manage Apache Tomcat 11 throughout its operational lifecycle. You will install and configure instances, deploy Jakarta EE web applications, secure network and application access, monitor server health, optimise performance and design resilient deployment architectures.
• Understand Tomcat 11 architecture and its role within the Jakarta EE ecosystem
• Select and configure an appropriate supported Java runtime
• Deploy Servlet, Pages and WebSocket applications
• Manage server.xml, context.xml, web.xml and application resources
• Configure TLS, authentication, realms and role-based access
• Monitor Tomcat through logs, JMX, metrics and diagnostic tools
• Tune connectors, thread pools, memory and JVM settings
• Operate Tomcat behind reverse proxies and load balancers
• Configure clustering and HTTP session replication
• Package and operate Tomcat in containerised environments
• Migrate Java EE applications from Tomcat 9 to Tomcat 10 or 11
• Replace obsolete Security Manager controls with modern isolation and least-privilege measures
• Basic knowledge of Java applications and web technologies
• Familiarity with Linux or Windows system administration
• Basic understanding of HTTP, networking and TLS
• Experience using command-line tools and editing configuration files
• Familiarity with Java archives and application deployment is beneficial
• Previous Tomcat administration experience is helpful but not required
*We customize the course outline and content to your specific needs and relevant use cases.
Day 1: Architecture, installation and application configuration
Module 1: Tomcat 11 and the Jakarta EE web platform
• Understanding the role of Tomcat as a Servlet and web application container
• Reviewing the Tomcat engine, services, connectors, hosts, contexts and web applications
• Understanding the supported Jakarta Servlet, Pages, Expression Language and WebSocket APIs
• Distinguishing Tomcat from full Jakarta EE application servers
Module 2: Java requirements and Tomcat installation
• Selecting a supported Java runtime for Tomcat 11
• Installing Tomcat from binary distributions or operating-system packages
• Understanding CATALINA_HOME, CATALINA_BASE and the installation directory structure
• Running Tomcat interactively or as a managed operating-system service
• Managing environment variables, service accounts and file permissions
Module 3: Deploying Jakarta EE web applications
• Understanding standard web application structure and deployment descriptors
• Packaging and deploying WAR files and expanded applications
• Deploying, redeploying and undeploying applications safely
• Using static deployment, automatic deployment and the Manager application
• Deploying Servlet, Jakarta Pages and WebSocket-based applications
Module 4: Server and application configuration
• Understanding the structure and responsibilities of server.xml
• Managing global, host-level and application-specific context configuration
• Working with context.xml, web.xml and META-INF/context.xml
• Configuring JNDI resources, JDBC data sources and connection pools
• Separating installation files, instance configuration and application configuration
Day 2: Security, monitoring and performance
Module 5: TLS and secure deployment
• Configuring HTTPS connectors, certificates and private keys
• Selecting protocols, cipher suites and certificate formats
• Redirecting insecure requests and protecting session cookies
• Applying secure connector, host and application settings
• Coordinating TLS termination between Tomcat and a reverse proxy
Module 6: Authentication, realms and access control
• Understanding container-managed authentication and authorisation
• Configuring users, roles and application security constraints
• Selecting file-based, JDBC, directory-based or combined realms
• Securing the Manager and Host Manager applications
• Applying least privilege to service accounts, administrators and deployed applications
Module 7: Logging, JMX and troubleshooting
• Configuring Tomcat and application logging
• Working with JULI, access logs and application logging frameworks
• Monitoring components and runtime attributes through JMX
• Exposing operational metrics to external monitoring systems
• Diagnosing deployment failures, class-loading problems, memory leaks and blocked requests
Module 8: Performance and JVM tuning
• Understanding connectors, executors, request threads and connection queues
• Tuning thread pools, timeouts, request limits and keep-alive behaviour
• Configuring JVM heap, garbage collection and runtime options
• Monitoring memory, threads, sessions, database pools and response times
• Testing changes and avoiding unsupported general-purpose tuning values
Day 3: Scalable deployment, containers and migration
Module 9: Reverse proxies and load balancing
• Operating Tomcat behind Apache HTTP Server, IIS or another reverse proxy
• Forwarding client addresses, protocols, hosts and ports correctly
• Comparing HTTP proxying with AJP-based integration
• Configuring load balancing, sticky sessions and health checks
• Securing communication between proxies and Tomcat instances
Module 10: Clustering and session replication
• Understanding stateless scaling and replicated session architectures
• Marking applications as distributable and preparing session data for replication
• Comparing all-to-all and backup-based session replication
• Configuring cluster membership, replication managers and valves
• Testing node failure, session continuity and recovery behaviour
Module 11: Containerised Tomcat deployment
• Building maintainable Tomcat container images
• Separating images, application artefacts and runtime configuration
• Managing secrets, certificates, volumes and environment-specific settings
• Defining health checks, resource limits and graceful termination
• Designing container deployments for immutable replacement and horizontal scaling
Module 12: Migration and modern security isolation
• Assessing applications and configurations currently running on Tomcat 9
• Migrating Java EE package references from javax to jakarta
• Using automated migration tools and reviewing changes manually
• Moving through Tomcat 10 where required and addressing Tomcat 11 compatibility changes
• Rebuilding configuration from the defaults of the target Tomcat version
• Replacing Security Manager policies with dedicated instances, containers or virtual machines
• Applying operating-system permissions, network isolation, container controls and restricted service identities
Hands-on learning with expert instructors at your location for organizations.
Master new skills guided by experienced instructors from anywhere.
