Skip to main content

Configuration Examples

This page provides complete configuration examples for common "middleware × certificate format" combinations. Each example includes two parts: the certificate mounting configuration on the service side, and the installation point configuration for clmBot's config.yaml.

The paths in the examples are demonstration values. Replace them with the paths in your actual environment. For field descriptions, see Configuration Reference.

nginx + PEM​

Service-Side Certificate Configuration​

Mount the certificate in the nginx site configuration using ssl_certificate and ssl_certificate_key:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    location / {
        root /usr/share/nginx/html;
    }
}
Note

nginx requires the ssl_certificate file to contain the complete certificate chain (site certificate + intermediate certificate). Therefore, it is recommended to leave ca_path empty in the clmBot installation point, and clmBot will merge the complete certificate chain into cert_path.

clmBot installation point configuration​

servers:
  - id: nginx_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /etc/nginx/ssl/example.com.crt
        ca_path: ""
        key_path: /etc/nginx/ssl/example.com.key
    after_script: |
      nginx -t && nginx -s reload

Apache + PEM​

Server-side certificate configuration​

Mount the certificate in the Apache site configuration using directives such as SSLCertificateFile:

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile      /etc/httpd/ssl/example.com.crt
    SSLCertificateKeyFile   /etc/httpd/ssl/example.com.key
    SSLCertificateChainFile /etc/httpd/ssl/example.com.ca.crt
</VirtualHost>
Information
  • Apache 2.4.8 and later can also merge the certificate chain directly into the SSLCertificateFile file. In this case, SSLCertificateChainFile can be omitted, and the ca_path in the clmBot installation point should be left blank accordingly.
  • Select the service name based on the distribution: httpd for RHEL/CentOS, and apache2 for Debian/Ubuntu.

clmBot installation point configuration​

servers:
  - id: apache_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /etc/httpd/ssl/example.com.crt
        ca_path: /etc/httpd/ssl/example.com.ca.crt
        key_path: /etc/httpd/ssl/example.com.key
    after_script: |
      apachectl configtest && systemctl restart httpd.service

Tomcat + JKS​

Server-side certificate configuration​

Tomcat 8.5 and above mounts the JKS keystore in conf/server.xml via SSLHostConfig:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/opt/tomcat/conf/example.com.jks"
                     certificateKeystorePassword="<keystore密码>"
                     certificateKeyAlias="tomcat"
                     certificateKeyPassword="<私钥密码>"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

clmBot Installation Point Configuration​

servers:
  - id: tomcat_jks
    sub_code: <证书订阅号>
    format:
      jks:
        path: /opt/tomcat/conf/example.com.jks
        alias: tomcat
        key_pass: <私钥密码>
        store_pass: <keystore密码>
    after_script: |
      export JAVA_HOME=/usr/java
      /opt/tomcat/bin/shutdown.sh
      /opt/tomcat/bin/startup.sh
Information

If Tomcat is managed by systemd, after_script can be simplified to systemctl restart <tomcat 服务名>.

Tomcat + PEM​

Server-side certificate configuration​

Tomcat 8.5 and later supports using PEM files directly, without converting to JKS:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeyFile="/opt/tomcat/ssl/example.com.key"
                     certificateFile="/opt/tomcat/ssl/example.com.crt"
                     certificateChainFile="/opt/tomcat/ssl/example.com.ca.crt"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

clmBot installation point configuration​

servers:
  - id: tomcat_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /opt/tomcat/ssl/example.com.crt
        ca_path: /opt/tomcat/ssl/example.com.ca.crt
        key_path: /opt/tomcat/ssl/example.com.key
    after_script: |
      export JAVA_HOME=/usr/java
      /opt/tomcat/bin/shutdown.sh
      /opt/tomcat/bin/startup.sh

Custom Service + PFX​

Suitable for services that use certificates in the form of a single-file certificate bundle (PKCS#12). In after_script, you can use script template variables:

servers:
  - id: app_pfx
    sub_code: <证书订阅号>
    format:
      pfx:
        path: /opt/app/ssl/example.com.pfx
        key_pass: <PFX密码>
    after_script: |
      echo "certificate updated at {{ .DATETIME }}"
      /usr/bin/systemctl restart example-app.service

Verification​

After configuration is complete, you can manually trigger an update to verify the entire process:

./clm-bot-linux-amd64 update-certificate

After confirming that the certificate file has been updated, the service has been reloaded, and the new certificate is in effect, configure automatic updates according to Certificate Update Method.

Last updated on