Installing Tomcat 9 on CentOS 7

Legacy installation notice: This URL belongs to an older CentOS 7 and Tomcat 9 installation guide. CentOS Linux 7 reached end of life on 30 June 2024. Do not use it for a new production deployment. The workflow below helps assess an existing installation and prepare a move to a supported system. See the CentOS lifecycle announcement.

New installation guide: Install packaged Tomcat 10.1 on Ubuntu 24.04 LTS. Use this separate guide when preparing the replacement host.

Tomcat runs Java web applications, not JavaScript

Tomcat is a container for Java Servlet, JSP and related Java web technologies. Java and JavaScript are different languages. Tomcat 9 requires Java 8 or later, but that minimum does not make an old Java 8 patch level secure. Consult Apache's runtime instructions for the environment requirements.

Inventory the current installation

These checks do not change configuration. Substitute the real service name if it is not tomcat.

cat /etc/os-release
java -version
systemctl status tomcat --no-pager
systemctl cat tomcat
journalctl -u tomcat -n 100 --no-pager

The Java executable in your shell may differ from the service runtime. Inspect its JAVA_HOME, JRE_HOME, startup script and environment files. Redact credentials, connection strings and personal data before sharing logs.

Fixing the download URL is not an upgrade plan

The original article downloaded Tomcat 9.0.12. That package is not a current deployment recommendation. Finding it in an Apache archive does not establish that it is safe to expose. Choose a supported operating system, patched runtime and application-compatible Tomcat branch together.

Apache has announced the end of 9.0.x support for 31 March 2027. Moving to Tomcat 10 or later is not merely a directory rename: Java EE applications need consideration of the javax.* to jakarta.* change and their dependencies. Check the Apache release announcements and migration guide before choosing the destination.

Build the destination separately

1. Back up application files, configuration, certificates and databases; verify recovery and define rollback criteria.
2. Prepare a separate supported host or staging environment. Do not copy a new distribution over the running installation.
3. Install a suitable Java runtime and obtain the chosen Tomcat distribution from its official source. Verify its signature or checksum.
4. Run the service under a dedicated restricted account. Distinguish software files from writable logs and temporary directories.
5. Set the runtime environment in service configuration. Do not assume systemd reads your interactive shell's .bashrc.

CATALINA_HOME identifies the distribution, while CATALINA_BASE identifies the instance configuration and working area. Startup scripts can infer some values, but explicit service configuration is easier to audit and migrate.

Test more than the page on port 8080

A welcome page does not prove that the application is ready. Test authentication, database access, uploads, service restart and HTTPS through the reverse proxy. Restrict management applications rather than exposing them publicly. Review bind addresses, firewall rules and deployment-specific settings against the Tomcat security guide before switching traffic.