Как Tomcat знает, какой сервер-сертификат использовать?

Question

Наличие этого server.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />

  <GlobalNamingResources>
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>

  <Service name="Catalina">
    <Connector port="8009" protocol="AJP/1.3" redirectPort="443" />
    <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"></Connector>

    <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" scheme="https" secure="true" SSLEnabled="true" keystoreFile="${user.home}/.keystore" keystorePass="<password>" sslProtocol="TLS" clientAuth="true" />
    <Engine name="Catalina" defaultHost="localhost" startStopThreads="8">
        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
               resourceName="UserDatabase" />
      <Host name="www.abc.com"  appBase="abc" unpackWARs="true" autoDeploy="false" copyXML="true">
      </Host>
      <Host name="www.def.com"  appBase="def" unpackWARs="true" autoDeploy="false" copyXML="true">
      </Host>
   </Engine>
  </Service>
</Server>

Как Tomcat знает, какой сертификат использовать?