To create and sign the Tomcat certificate in CUCM you would create a CSR by going to certificate management in OS admin web page. You can select either multi SAN, that would be preferred, or per node. Then you download the CSR and create the signed certificate in your CA from this. The outcome of this is a CER file that you upload to CUCM. For multi SAN you would upload it to the publisher and it will distribute it to all other nodes in the cluster. You would also need to upload the CA and any intermediate certificate to the tomcat trust store. Once completed you will need to restart tomcat service on each node from CLI.
