Skip to main content

Quick Start

This page guides you through deploying clmBot within 15 minutes and completing a full certificate renewal process.

Before you begin, please confirm:

  • You have activated the sslTrus CaaS service and can log in to the management console.
  • The target server can make outbound access to cloud services.
  • You have administrator privileges on the server (for installing and initializing clmBot).

Step 1: Generate AccessKey / AccessSecret​

Log in to the management console, go to sslTrus CaaS Service -> Product Details -> SSL Certificate Details, and click 生成AK/SK to obtain the AccessKey (AK) and AccessSecret (SK).

Note

Keep your AccessKey and AccessSecret safe. Do not commit the AccessSecret to a Git repository, write it into public scripts, or send it to untrusted third-party systems. If you suspect a leak, regenerate it in the management console.

Step 2: Download clmBot and upload it to the server​

Download the program for your system version from the clmBot release page:

Download clmBot

Select the version matching your server's operating system and architecture (such as clm-bot-linux-amd64) and upload it to the server. It is recommended to create a dedicated installation directory for it, such as /opt/clm-bot.

mkdir -p /opt/clm-bot && cd /opt/clm-bot
chmod 755 clm-bot-linux-amd64

Step 3: Log in and Connect​

Run the login command in the installation directory to complete the connection:

./clm-bot-linux-amd64 login

Follow the prompts to first select the cloud address number (or directly enter the cloud address), then enter AccessKey and AccessSecret in sequence.

After successful login, clmBot will generate the config.yaml configuration file in the installation directory to save the connection information.

Step 4: Activate the node in the admin console​

Log in to the admin console and go to the clmBot node list. You will see a newly added clmBot node. Click the Allow access toggle on the right side of the node to activate it.

Information

Newly connected nodes are disabled by default. Only after activation in the admin console can clmBot retrieve certificates from the cloud properly.

Step 5: Discover certificates on the server​

Run the certificate discovery command to automatically scan the certificates deployed on the server and their storage paths:

./clm-bot-linux-amd64 discover-certificate

After the command executes, the found certificate information will be listed in a table (source, type, issuer, path, domain, etc.). Enter the certificate number to upload and confirm adding it to the admin console:

  • all: Upload all
  • none: Do not upload
  • 1,3-5: Select by number, supports range notation

After a successful upload, these certificates will appear in the admin console as installation points, and clmBot will generate the corresponding configuration for each installation point in config.yaml in the current directory.

Information

In the auto-generated configuration, each installation point includes the before_script and after_script fields, where after_script is the reload script executed after certificate renewal. You need to confirm whether it is applicable to your actual environment. For field meanings, see Configuration Reference.

Step 6: Complete the first certificate renewal​

After setting an automatic reissue cycle for a certificate in the admin console (see Certificate Renewal Methods), you can manually trigger a renewal to verify the entire workflow:

./clm-bot-linux-amd64 update-certificate

After execution, clmBot checks whether a newer certificate is available in the cloud:

  • Local certificate is already up to date: outputs a prompt and skips.
  • A new certificate exists in the cloud: backs up the local certificate file (generates a .bak backup), writes the new certificate, and executes after_script to reload the service.

Next Steps​

Last updated on