Installation Point Management

An installation point is a certificate deployment target in the clmBot configuration file, consisting of the certificate format (format), file path, and update script. A single clmBot node can manage multiple installation points.

clmBot provides the following installation point management commands:

Command	Purpose
discover-certificate	Automatically scan certificates on the local machine (and Docker containers) and add them as installation points
add-server	Interactively add installation points manually (writes only to the local configuration)
sync-server	Sync local installation points to the cloud and calibrate certificate subscription numbers
setup	Start the local web configuration page to manage installation points in the browser
query-certificate	View read-only information about the certificates currently deployed at each installation point

Automatically Discover Certificate Installation Points

Run discover-certificate to automatically scan certificates already deployed on the server:

./clm-bot-linux-amd64 discover-certificate

Scanning scope:

• Linux: nginx, Apache HTTP Server, Tomcat.
• Windows: IIS.

After the command is executed, the discovered certificate information (source, type, issuing CA, subject, path, access point, serial number, etc.) is listed in table form. Enter the certificate number to confirm uploading to the backend for management:

• all: Upload all
• none: Do not upload
• 1,3-5: Select by number, supports range notation

After a successful upload, these certificates appear as installation points in the management backend, and clmBot generates the corresponding configuration for each installation point in config.yaml.

Available Parameters

Parameter	Description
--yes / -y	Skip selection and upload all installation points
--select	Directly specify the sequence number to upload (all, none, or 1,3-5), mutually exclusive with --yes
--skip-filter / -s	Skip certificate domain (SAN) filtering; by default, only certificates matching the cloud-allowed domains are uploaded
--scan-docker / -d	Additionally scan nginx, Apache, and Tomcat configurations inside Docker containers (Linux/macOS only)
--scan-only	Only scan and output all certificate installation points without logging in or uploading, suitable for pre-deployment preview

Docker container scenarios

When using --scan-docker, clmBot scans running nginx, Apache, and Tomcat containers on the local machine:

• The certificate path inside the container must already be mounted to the host and writable; otherwise, that installation point will be ignored.
• The access point for the installation point is generated using the IP and port published by the host.
• You can use the CLMBOT_NGINX_CONTAINERS, CLMBOT_APACHE_CONTAINERS, and CLMBOT_TOMCAT_CONTAINERS environment variables to specify the container names to scan (separate multiple container names with semicolons).

Manually add an installation point

When a cloud certificate is not deployed on the server, or automatic scanning fails to identify it, you can manually add an installation point:

./clm-bot-linux-amd64 add-server 260101AABBCC pem

The first parameter is the certificate subscription ID, and the second parameter is the certificate format (pem, pfx, jks, iis, or exchange). Follow the prompts to enter the installation point ID and the file path for the corresponding format.

add-server only writes the installation point to the local config.yaml and does not automatically upload it to the cloud; if you need to sync it to the cloud, run sync-server next.

Sync Installation Points to the Cloud

sync-server Upload the installation point from the local configuration to the cloud, and use the subscription ID returned by the cloud to supplement or calibrate the local configuration:

./clm-bot-linux-amd64 sync-server

After execution, list the local installation points and select the items to upload by number (also supports all, none, 1,3-5), or use --yes to upload all, or --select to specify directly.

Information

• When the local subscription number is empty, it will be automatically supplemented; when inconsistent with the cloud, conflicts will be listed and overwritten only after confirmation.
• Exchange-format installation points are not supported for synchronization at this time.

Local Web Configuration Page

If you are unfamiliar with the command line, you can use setup to launch the local configuration page, and add, edit, and delete installation points in the browser:

./clm-bot-linux-amd64 setup

After execution, an access address with a random token will be output (in the form of http://localhost:<端口>/setup?token=...). Open it in a browser on the server itself to manage installation points.

Note

The configuration page only listens on the server's loopback address and cannot be accessed from other hosts. Do not disclose the tokenized access address to unrelated personnel; after use, press Ctrl+C (or follow the prompts) to stop the page.

To specify a port, use the -a parameter (for example, setup -a localhost:8900); in older browser environments, you can add --legacy to use the plain HTML configuration page.

View certificate information for installation points

query-certificate provides read-only viewing of the certificate information currently deployed at each installation point (subject, issuer, serial number) and does not modify certificate files:

./clm-bot-linux-amd64 query-certificate

By default, all installation points are queried. You can use the -i parameter to specify an installation point ID, for example, query-certificate -i nginx_pem.

Next steps

After the installation point is ready, configure the certificate renewal method. See Certificate renewal method.