Tomcat won't bind 443 (OwnSona Manual)

BindException: Permission denied in journalctl -u ownsona.service, or Address already in use.

Missing AmbientCapabilities. Check /etc/systemd/system/ownsona.service has AmbientCapabilities=CAP_NET_BIND_SERVICE. If not, the unit was edited and lost the cap. Restore it from sql/ownsona.service.
Another process holds the port. sudo ss -tlnp | grep :443. Often a leftover manually-launched Tomcat (startup.sh). Kill it.
Keystore file missing or unreadable by the ownsona user. ls -l /home/ownsona/tomcat/conf/tomcat.p12. Should be owner=ownsona, mode 600.