Configuration Reference

The behavior of clmBot is controlled by the config.yaml configuration file in the installation directory. This file is automatically generated when running login, discover-certificate, or add-server, and can also be edited manually.

By default, clmBot reads config.yaml from the current directory. You can also specify the configuration file path using the global parameter -c:

./clm-bot-linux-amd64 -c /opt/clm-bot/config.yaml update-certificate

Overall structure

app:
  base_url: https://<云端地址>
  ignore_ssl: false
  access_key: YOUR_ACCESS_KEY
  access_secret: YOUR_ACCESS_SECRET

servers:
  - id: nginx_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /etc/nginx/ssl/example.com.crt
        ca_path: /etc/nginx/ssl/example.com.ca.crt
        key_path: /etc/nginx/ssl/example.com.key
    before_script: |
      ...
    after_script: |
      nginx -t && nginx -s reload

app: Access configuration

Field	Description
base_url	Cloud API address. Fill in according to the delivery information; generally no modification is needed.
ignore_ssl	Whether to ignore HTTPS certificate verification. Enable this only in controlled environments that use self-signed certificates.
access_key	AccessKey assigned by the cloud.
access_secret	AccessSecret assigned by the cloud. After the plaintext value is saved by the program for the first time, it is automatically migrated to an encrypted value beginning with ENC1+.

servers: Installation point list

Each servers[] entry corresponds to one certificate installation point:

Field	Description
id	Installation point identifier. We recommend using a name with business meaning.
sub_code	Certificate subscription number. It corresponds to the certificate subscription in the management console, and clmBot uses it to obtain the latest certificate.
format	Certificate format and file path, must retain only one of pem, pfx, jks, iis, exchange
before_script	Script executed before the update; a script failure will interrupt the update of the current installation point
after_script	Script executed after the update, typically used to reload middleware services

format: Certificate format

pem

Applicable to scenarios where PEM files are used, such as nginx, Apache HTTP Server, and Tomcat:

Field	Description
cert_path	Path to the site certificate file. On renewal, the leaf certificate is written; if ca_path is empty, the full certificate chain is also written
ca_path	Path to the CA chain file; can be empty
key_path	Path to the private key file

pfx

For services that require a single-file certificate bundle (PKCS#12):

Field	Description
path	Path to the PFX file
key_pass	Password for the PFX private key; can be left empty if the target service does not require a password

jks

For Java keystore scenarios such as Tomcat:

Field	Description
path	Path to the JKS file
alias	Alias of the certificate entry. When empty, it can be inferred automatically only if the keystore has a single entry
key_pass	Entry private key password
store_pass	keystore password

iis

For Windows IIS HTTPS bindings:

Field	Description
name	IIS site name, viewable in IIS Manager
addr	HTTPS binding IP; * means all IPs
port	HTTPS binding port
domain	HTTPS binding domain; can be left empty when no SNI domain is used

The IIS installation point uses clmBot's built-in script to automatically import the certificate and update bindings, so script configuration is usually not required.

exchange

For Windows Exchange service certificates:

Field	Description
services	List of Exchange services that need to enable the new certificate, such as ["IIS", "SMTP", "POP", "IMAP"]

Script Execution Notes

before_script and after_script are executed in the following order when a certificate is renewed:

1. Back up the local certificate files (generating a timestamped .bak backup).
2. Execute before_script; if it fails, abort the update for the current installation point.
3. Write the new certificate.
4. Execute after_script to reload or restart the middleware service.

When the local certificate is already up to date, the entire renewal (including the script) will be skipped. If you need to force execution after_script, you can use the --force-after parameter.

The script is executed on Linux via bash and on Windows via powershell.exe -NoProfile -ExecutionPolicy Bypass.

Script Template Variables

When writing before_script / after_script, you can use the following template variables, which clmBot will replace with actual values before execution.

Common variables:

Variable	Description
{{ .ID }}	Installation point id
{{ .SUB_CODE }}	certificate subscription number
{{ .OS_TYPE }}	Operating system type (windows / linux / darwin)
{{ .IS_WINDOWS }}	Is Windows (true / false)
{{ .IS_LINUX }}	Is Linux (true / false)
{{ .TIMESTAMP }}	Current timestamp (seconds)
{{ .DATETIME }}	Current date and time (2006-01-02 15:04:05 format)
{{ .DATE }}	Current date (2006-01-02 format)
{{ .LATEST }}	Whether the certificate is up to date (true / false). When used together with --force-after, it can be used in scripts to determine whether to skip subsequent operations

Variables provided by certificate format:

Format	Variable	Description
pem	{{ .PEM_CERT_PATH }}	Site certificate file path
pem	{{ .PEM_CA_PATH }}	CA chain file path
pem	{{ .PEM_KEY_PATH }}	Private key file path
pfx	{{ .PFX_PATH }}	PFX file path
pfx	{{ .PFX_KEY_PASS }}	PFX private key password
jks	{{ .JKS_PATH }}	JKS file path
jks	{{ .JKS_ALIAS }}	Certificate entry alias
jks	{{ .JKS_KEY_PASS }}	Entry private key password
jks	{{ .JKS_STORE_PASS }}	Keystore password
iis	{{ .IIS_SITE_NAME }}	IIS site name
iis	{{ .IIS_IPADDR }}	HTTPS binding IP
iis	{{ .IIS_PORT }}	HTTPS binding port
iis	{{ .IIS_DOMAIN }}	HTTPS bound domain
exchange	{{ .EXCHANGE_SERVICES }}	Exchange service name list (comma-separated)

Security Recommendations

• config.yaml contains access credentials and the private key path. Restrict its file permissions so that only the runtime account can read and write it (e.g., chmod 600 config.yaml).
• After AccessSecret is saved, it is stored in encrypted form, but you should still avoid copying the configuration file to untrusted locations.
• Use a dedicated runtime account for clmBot and grant it least-privilege permissions. See Runtime Permission Requirements.