Certificate delivery infrastructure

Deploy your certificates automatically.

clmbot securely delivers and deploys SSL/TLS certificates across servers and private environments.

Download v0.6.6Read the getting started guide
clmbot automated certificate deployment workflow
LOCAL DELIVERY RUNCertificate deployment run
Run complete
UPSTREAMCertificate source
CaaS / private CLMOther certificate services can be adapted
HTTPS / mTLS
Runs in your environmentclmbot
Scheduled pull
  1. 01
    Connect to certificate serviceRetrieve certificate and deployment data
    Done
  2. 02
    Validate certificate and keyCheck key match and validity period
    Done
  3. 03
    Back up and write safelyPreserve old files and restrict access
    Done
  4. 04
    Validate and reload serviceRun reviewed scripts
    Done
DEPLOYED TOServers and private environments
  • Nginx
  • Apache
  • Tomcat
  • IIS
  • K8s
v0.6.6Current public release
5OS and architecture builds
FreeFor non-commercial use only
CDNCurrent official download source

Built for server-side delivery

clmbot runs in a customer-controlled environment and connects an upstream certificate service to servers, middleware, and certificate directories. It can connect to CaaS and continue adapting to private CLM or other certificate services.

Compare the two operating modes
Recommended default

Scheduled pull

clmbot connects outbound to the upstream service and requires no inbound port, making it suitable for private networks and strict firewalls.

Advanced mode

Remote push

The upstream service pushes over mTLS through a controlled inbound port, for centrally managed, near-real-time delivery.

Complete the deployment loop, from discovery to activation

Turn manual certificate copying, path changes, and service reloads into a configured, logged, repeatable workflow.

  1. 01

    Discover existing certificates

    Scan certificate files and deployment paths on a server, then generate a configuration you can inspect and maintain.

  2. 02

    Retrieve new certificates

    Connect to CaaS, a private CLM, or another certificate service through an available adapter.

  3. 03

    Replace files safely

    Back up existing files before writing new certificates and restrict file permissions to the minimum required.

  4. 04

    Reload services

    Run reviewed before_script and after_script commands to validate configuration and reload the target service.

  5. 05

    Keep delivery automated

    Use scheduled pull or remote push to make certificate updates repeatable.

First, decide whether clmbot needs to be installed

Server deployment and cloud-product API delivery are different paths. The platform catalog keeps these target types separate.

Install clmbot

Servers and private environments

For physical servers, virtual machines, containers, Kubernetes, and customer-managed web services.

  • Nginx
  • Apache
  • Tomcat
  • IIS
  • Kubernetes
Usually no installation

Cloud-product API delivery

CaaS is a separate certificate lifecycle management service that can deliver certificates directly to CDNs, WAFs, load balancers, and similar products through vendor APIs.

  • CDN
  • WAF
  • SLB / ALB
  • API gateway
View platforms and deployment targets

Least privilege is not optional

Run clmbot under a dedicated system account with access only to required certificate paths and exact reload commands. Scheduled pull requires no inbound port.

Read the least-privilege guide
Runtime identity
Dedicated clmbot account
Directory access
Certificate-directory ACLs
Command access
Exact sudoers rules
Inbound network
None for scheduled pull

Help make certificate automation more reliable

Discussions and Issues are open for questions, reproducible problems, ideas, and deployment experience. Source code is not currently public; any future open-source release will be announced separately.

Visit the communityVisit GitHub