Skip to main content

Configuration Examples

This page provides complete configuration examples for common "middleware × certificate format" combinations. Each example contains two parts: the certificate mounting configuration on the service side, and the config.yaml installation point configuration for clmBot.

The paths in the examples are demonstration values. Replace them with the paths in your actual environment. For field descriptions, see Configuration Reference.

nginx + PEM​

Service-Side Certificate Configuration​

Mount the certificate in the nginx site configuration using ssl_certificate and ssl_certificate_key:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;

    location / {
        root /usr/share/nginx/html;
    }
}
Information

nginx requires the ssl_certificate file to contain the complete certificate chain (site certificate + intermediate certificate). Therefore, it is recommended to leave ca_path empty in the clmBot installation point, and clmBot will merge the complete certificate chain into cert_path.

clmBot Installation Point Configuration​

servers:
  - id: nginx_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /etc/nginx/ssl/example.com.crt
        ca_path: ""
        key_path: /etc/nginx/ssl/example.com.key
    after_script: |
      nginx -t && nginx -s reload

Apache + PEM​

Server-Side Certificate Configuration​

In the Apache site configuration, mount the certificate using directives such as SSLCertificateFile:

<VirtualHost *:443>
    ServerName example.com

    SSLEngine on
    SSLCertificateFile      /etc/httpd/ssl/example.com.crt
    SSLCertificateKeyFile   /etc/httpd/ssl/example.com.key
    SSLCertificateChainFile /etc/httpd/ssl/example.com.ca.crt
</VirtualHost>
Information
  • Apache 2.4.8 and later can also merge the certificate chain directly into the SSLCertificateFile file. In this case, SSLCertificateChainFile can be omitted, and the ca_path in the clmBot installation point can be left blank accordingly.
  • Select the service name according to the distribution: for RHEL/CentOS it is httpd, and for Debian/Ubuntu it is apache2.

clmBot installation point configuration​

servers:
  - id: apache_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /etc/httpd/ssl/example.com.crt
        ca_path: /etc/httpd/ssl/example.com.ca.crt
        key_path: /etc/httpd/ssl/example.com.key
    after_script: |
      apachectl configtest && systemctl restart httpd.service

Tomcat + JKS​

Server-side certificate configuration​

Tomcat 8.5 and above mounts the JKS keystore in conf/server.xml through SSLHostConfig:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="/opt/tomcat/conf/example.com.jks"
                     certificateKeystorePassword="<keystore密码>"
                     certificateKeyAlias="tomcat"
                     certificateKeyPassword="<私钥密码>"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

clmBot Installation Point Configuration​

servers:
  - id: tomcat_jks
    sub_code: <证书订阅号>
    format:
      jks:
        path: /opt/tomcat/conf/example.com.jks
        alias: tomcat
        key_pass: <私钥密码>
        store_pass: <keystore密码>
    after_script: |
      export JAVA_HOME=/usr/java
      /opt/tomcat/bin/shutdown.sh
      /opt/tomcat/bin/startup.sh
Info

If Tomcat is managed by systemd, after_script can be simplified to systemctl restart <tomcat 服务名>.

Tomcat + PEM​

Server-side certificate configuration​

Tomcat 8.5 and above supports using PEM files directly, with no need to convert to JKS:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeyFile="/opt/tomcat/ssl/example.com.key"
                     certificateFile="/opt/tomcat/ssl/example.com.crt"
                     certificateChainFile="/opt/tomcat/ssl/example.com.ca.crt"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

clmBot installation point configuration​

servers:
  - id: tomcat_pem
    sub_code: <证书订阅号>
    format:
      pem:
        cert_path: /opt/tomcat/ssl/example.com.crt
        ca_path: /opt/tomcat/ssl/example.com.ca.crt
        key_path: /opt/tomcat/ssl/example.com.key
    after_script: |
      export JAVA_HOME=/usr/java
      /opt/tomcat/bin/shutdown.sh
      /opt/tomcat/bin/startup.sh

Custom Service + PFX​

Applicable to services that use certificates as a single-file certificate bundle (PKCS#12). In after_script, you can use script template variables:

servers:
  - id: app_pfx
    sub_code: <证书订阅号>
    format:
      pfx:
        path: /opt/app/ssl/example.com.pfx
        key_pass: <PFX密码>
    after_script: |
      echo "certificate updated at {{ .DATETIME }}"
      /usr/bin/systemctl restart example-app.service

Verification​

After configuration is complete, you can manually trigger an update to verify the entire flow:

./clm-bot-linux-amd64 update-certificate

After confirming that the certificate file has been updated, the service has been reloaded, and the new certificate has taken effect, configure automatic updates according to the certificate update method.

Last updated on