Navigation

clmBot is a lightweight client deployed on your internal network servers, used to automatically complete the deployment and renewal of SSL certificates: it retrieves the latest certificate from the cloud, writes it to the certificate installation point on the server, and executes configured scripts to reload middleware services so that the new certificate takes effect immediately.

How It Works

The certificate renewal process of clmBot is as follows:

1. Before the certificate expires, the cloud automatically completes certificate reissuance and generates a new certificate.
2. clmBot obtains the latest certificate through cloud push or scheduled pull.
3. clmBot backs up and replaces the local certificate files on the server.
4. clmBot executes the configured reload script (after_script) to make the new certificate take effect.

The entire process requires no manual server login to replace certificates, nor does it expose the server's management entry to the outside world.

Supported Renewal Methods

clmBot supports two certificate renewal methods, which can be selected separately on different servers:

Renewal Method	Working Mode	Port Requirements	Applicable Scenarios
Cloud push	The management console initiates a push, and the clmBot service on the server receives and updates the certificate	Requires opening the 8862/tcp inbound port	Network policies allow opening inbound ports and require immediate updates
Scheduled pull	clmBot periodically checks and pulls the latest certificate through crontab or Windows Task Scheduler	No inbound port required, only outbound access to the cloud	Servers where inbound ports cannot be opened (recommended default method)

For detailed configuration methods, please refer to Certificate Renewal Methods.

Supported Platforms and Middleware

Supported operating systems:

• Linux (amd64)
• Windows (amd64)

Supported middleware and certificate formats:

Middleware	Certificate Format	Description
nginx	PEM	Certificate, CA chain, and private key deployed separately
Apache HTTP Server	PEM	Certificate, CA chain, and private key deployed separately
Tomcat	PEM / JKS	Supports PEM certificates or JKS keystore
IIS	IIS	Imports PFX and updates site bindings through built-in scripts; administrator privileges required
Exchange	Exchange	Enables certificates through built-in scripts; administrator privileges required
Others (custom scripts)	PFX, etc.	Supports any scenario through custom after_script

How to Choose Documentation

Usage Scenario	Recommended Page
First-time use and want to quickly deploy and complete a certificate renewal	Quick Start
Learn the detailed configuration of the two renewal methods	Certificate Renewal Methods
Manually add installation points, sync installation points from the console, and use the local web configuration page	Installation Point Management
View the meanings of config.yaml fields and script template variables	Configuration Reference
View complete certificate installation and reload examples for middleware such as nginx, Apache, and Tomcat	Configuration examples
Tighten clmBot's runtime permissions in production and configure sudoers	Runtime permission requirements
Register clmBot as a system service, upgrade versions, and view logs	Service-based deployment and upgrade

Quick Start

If you are using clmBot for the first time, we recommend following this path:

1. Generate an AccessKey / AccessSecret in the admin console.
2. Download clmBot and upload it to the server.
3. Run login to complete onboarding, and activate the node in the console.
4. Run discover-certificate to automatically discover certificates on the server.
5. Configure the update method (push or scheduled pull).

For complete steps, see Quick Start.