btw, I use below command to generate pfx file for tomcat.
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:xxx
And if certificates are renewed automatically, whether I need to rerun openssl command ?