As reported by David in the forums there is a bug in the Confconsole Let's Encrypt plugin on the standalone Tomcat appliance.
The workaround is pretty simple, you just need to re-run the Tomcat SSL firstboot script and restart Tomcat:
/usr/lib/inithooks/firstboot.d/16tomcat-sslcert
systemctl restart tomcat9.service
The "proper" fix would be to (re)run the inithook after getting the cert, but before restarting the Tomcat service.