Letsencrypt certificate with Tomcat and Certbot connection refused

The Certbot standalone feature will run a temporary web server on port 80, only for the lifetime of the validation request. It will not listen the remainder of the time.

You don’t need to add Apache or nginx.

Your could also configure Tomcat to also listen on port 80, should you feel better about doing it that way.