Installation Point Management
An installation point is a certificate deployment target in the clmBot configuration file, consisting of a certificate format (format), file path, and update script. A single clmBot node can manage multiple installation points.
clmBot provides the following installation point management commands:
| Command | Purpose |
|---|---|
discover-certificate | Automatically scan certificates on this machine (and in Docker containers) and add them as installation points |
add-server | Interactively add installation points manually (writes only to local configuration) |
sync-server | Sync local installation points to the cloud and calibrate certificate subscription numbers |
setup | Start the local web configuration page to manage installation points in a browser |
query-certificate | Read-only view of the currently deployed certificate information for each installation point |
Automatically discover certificate installation points
Run discover-certificate to automatically scan certificates already deployed on the server:
./clm-bot-linux-amd64 discover-certificate
Scan scope:
- Linux: nginx, Apache HTTP Server, Tomcat.
- Windows: IIS.
After the command is executed, the discovered certificate information is listed in a table (source, type, issuing authority, subject, path, access point, serial number, etc.). Enter the certificate number to confirm uploading to the management backend:
all: Upload allnone: Do not upload1,3-5: Select by number, with range notation supported
After a successful upload, these certificates appear in the management backend as installation points, and clmBot generates the corresponding configuration for each installation point in config.yaml.
Available parameters
| Parameter | Description |
|---|---|
--yes / -y | Skip selection and upload all installation points |
--select | Directly specify the sequence number to upload (all, none, or 1,3-5); mutually exclusive with --yes |
--skip-filter / -s | Skip certificate domain (SAN) filtering; by default, only certificates matching the cloud-allowed domains are uploaded |
--scan-docker / -d | Additionally scan nginx, Apache, and Tomcat configurations inside Docker containers (Linux/macOS only) |
--scan-only | Only scan and output all certificate installation points; does not log in or upload, suitable for pre-deployment preview |
Docker Container Scenarios
When using --scan-docker, clmBot scans running nginx, Apache, and Tomcat containers on the local machine:
- Certificate paths inside containers must already be mounted to the host and writable; otherwise, the installation point will be ignored.
- Access points for installation points will be generated using the IP and port published by the host.
- You can specify container names to scan through the
CLMBOT_NGINX_CONTAINERS,CLMBOT_APACHE_CONTAINERS, andCLMBOT_TOMCAT_CONTAINERSenvironment variables (multiple container names separated by semicolons).
Manually Adding Installation Points
When a cloud certificate is not deployed on the server, or automatic scanning fails to identify it, you can manually add installation points:
./clm-bot-linux-amd64 add-server 260101AABBCC pem
The first parameter is the certificate subscription number, and the second parameter is the certificate format (pem, pfx, jks, iis, or exchange). Follow the prompts to enter the installation point ID and the file path for the corresponding format.
add-server only writes the installation point to the local config.yaml and does not automatically upload it to the cloud; to sync to the cloud, proceed with sync-server.
Sync installation points to the cloud
sync-server Upload the installation point from the local configuration to the cloud, and use the subscription number returned by the cloud to supplement or calibrate the local configuration:
./clm-bot-linux-amd64 sync-server
After execution, the local installation points are listed. Select the item to upload by its sequence number (similarly supports all, none, and 1,3-5), or use --yes to upload all or --select to specify directly.
- When the local subscription ID is empty, it will be supplemented automatically; conflicts will be listed when inconsistencies with the cloud exist, and overwriting will occur only after confirmation.
- Installation points in Exchange format are not currently supported for synchronization.
Local Web Configuration Page
If you are unfamiliar with the command line, you can use setup to start the local configuration page and add, edit, and delete installation points in the browser:
./clm-bot-linux-amd64 setup
After execution, an access URL with a random token will be output (in the form of http://localhost:<端口>/setup?token=...). Open it in a browser on the server itself to manage the installation point.
The configuration page only listens on the server's loopback address and cannot be accessed from other hosts. Do not disclose the token-bearing access URL to unauthorized personnel; when finished, press Ctrl+C (or follow the prompts) to stop the page.
To specify a port, use the -a parameter (for example, setup -a localhost:8900); in older browser environments, add --legacy to use a plain HTML configuration page.
View installation point certificate information
query-certificate provides read-only viewing of the certificate information currently deployed at each installation point (subject, issuer, serial number) without modifying certificate files:
./clm-bot-linux-amd64 query-certificate
By default, all installation points are queried. You can use the -i parameter to specify an installation point ID, for example query-certificate -i nginx_pem.
Next Steps
After the installation point is ready, configure the certificate renewal method. See Certificate Renewal Method.