diff --git a/base/common/python/pki/__init__.py b/base/common/python/pki/__init__.py
index 4c4b3a3278b..dadf420968f 100644
--- a/base/common/python/pki/__init__.py
+++ b/base/common/python/pki/__init__.py
@@ -464,13 +464,18 @@ class PropertyFile(object):
     are maintained internally as a list of properties.
 
     Properties are strings of the format <name> <delimiter> <value> where
-    '=' is the default delimiter.
+    '=' is the default delimiter. The value can optionally be quoted.
     """
 
-    def __init__(self, filename, delimiter='='):
+    def __init__(self, filename, delimiter='=', quote=None):
         """ Constructor """
+
+        if quote and len(quote) > 1:
+            raise Exception('Invalid quote character: ' + quote)
+
         self.filename = filename
         self.delimiter = delimiter
+        self.quote = quote
 
         self.lines = []
 
@@ -568,8 +573,6 @@ def get(self, name):
         :type name: str
         :return: str -- value of property
         """
-        result = None
-
         for line in self.lines:
 
             # parse <key> <delimiter> <value>
@@ -582,10 +585,16 @@ def get(self, name):
             key = match.group(1)
             value = match.group(2)
 
-            if key.lower() == name.lower():
-                return value
+            if key.lower() != name.lower():
+                continue
+
+            # remove quotes if any
+            if self.quote and value.startswith(self.quote) and value.endswith(self.quote):
+                value = value[1:-1]
+
+            return value
 
-        return result
+        return None
 
     def set(self, name, value, index=None):
         """
@@ -599,6 +608,9 @@ def set(self, name, value, index=None):
         :type index: int
         :return: None
         """
+        if self.quote:
+            value = self.quote + value + self.quote
+
         for i, line in enumerate(self.lines):
 
             # parse <key> <delimiter> <value>
@@ -640,8 +652,15 @@ def remove(self, name):
             key = match.group(1)
             value = match.group(2)
 
-            if key.lower() == name.lower():
-                self.lines.pop(i)
-                return value
+            if key.lower() != name.lower():
+                continue
+
+            self.lines.pop(i)
+
+            # remove quotes if any
+            if self.quote and value.startswith(self.quote) and value.endswith(self.quote):
+                value = value[1:-1]
+
+            return value
 
         return None
diff --git a/base/common/python/pki/upgrade.py b/base/common/python/pki/upgrade.py
index eff51ec1cad..a144016ce42 100644
--- a/base/common/python/pki/upgrade.py
+++ b/base/common/python/pki/upgrade.py
@@ -43,7 +43,8 @@ class PKIUpgradeTracker(object):
 
     def __init__(self, name, filename, delimiter='=',
                  version_key='PKI_VERSION',
-                 index_key='PKI_UPGRADE_INDEX'):
+                 index_key='PKI_UPGRADE_INDEX',
+                 quote=None):
 
         self.name = name
         self.filename = filename
@@ -54,7 +55,7 @@ def __init__(self, name, filename, delimiter='=',
         # properties must be read and written immediately to avoid
         # interfering with scriptlets that update the same file
 
-        self.properties = pki.PropertyFile(filename, delimiter)
+        self.properties = pki.PropertyFile(filename, delimiter=delimiter, quote=quote)
 
         # run all scriptlets for each upgrade version
         self.remove_index()
diff --git a/base/server/python/pki/server/__init__.py b/base/server/python/pki/server/__init__.py
index 76c501fe348..cac4141496f 100644
--- a/base/server/python/pki/server/__init__.py
+++ b/base/server/python/pki/server/__init__.py
@@ -694,7 +694,7 @@ def create(self, force=False):
         # copy /etc/tomcat/tomcat.conf
         self.copy(Tomcat.TOMCAT_CONF, self.tomcat_conf, force=force)
 
-        tomcat_conf = pki.PropertyFile(self.tomcat_conf)
+        tomcat_conf = pki.PropertyFile(self.tomcat_conf, quote='"')
         tomcat_conf.read()
 
         # store JAVA_HOME from /usr/share/pki/etc/pki.conf
diff --git a/base/server/python/pki/server/upgrade.py b/base/server/python/pki/server/upgrade.py
index 2c5ae6400ca..d5480e23999 100644
--- a/base/server/python/pki/server/upgrade.py
+++ b/base/server/python/pki/server/upgrade.py
@@ -69,7 +69,8 @@ def get_tracker(self):
             '%s instance' % self.instance,
             INSTANCE_TRACKER % self.instance.conf_dir,
             version_key='PKI_VERSION',
-            index_key='PKI_UPGRADE_INDEX')
+            index_key='PKI_UPGRADE_INDEX',
+            quote='"')
 
         return self.tracker
 
diff --git a/base/server/share/conf/tomcat.conf b/base/server/share/conf/tomcat.conf
index 0ee187b8ba2..58aed04869f 100644
--- a/base/server/share/conf/tomcat.conf
+++ b/base/server/share/conf/tomcat.conf
@@ -57,7 +57,7 @@ TOMCAT_LOG="/var/log/pki/[pki_instance_name]/tomcat-initd.log"
 # put your own definitions here
 # (i.e. LD_LIBRARY_PATH for some jdbc drivers)
 
-PKI_VERSION=[application_version]
+PKI_VERSION="[application_version]"
 
 # Debian settings
 TOMCAT_USER="[pki_user]"