added a renewal service on the CA that requires 2-way SSL
also modified the embedded tomcat to always use SSL (1-way and 2-way as needed)