Hi Luca,
I looked at your recent changes and was wondering would you entail a possible scenario where tomcat does not manage certs and only listen on 8080 and node admin can run nginx/apache for ssl termination. The reason for this is that resource manager as kubernetes, swarm or mesos has tools like https://traefik.io for letting traffic into cluster and they can manage certificate directly from Let's encrypt which makes deployment easier. So having a possibility to run tomcat and ESGF node behind such proxy would be really helpful.
Between thanks for your work till now, I am looking forward to test it.