Skip to content


Paul Nguyen edited this page Feb 12, 2020 · 14 revisions

Using deploy api

Before you can deploy your cert, you must issue the cert first.

Here are the scripts to deploy the certs/key to the server/services.

1. Deploy the certs to your cpanel host

If you want to deploy using cpanel UAPI see 7.

(cpanel deploy hook is not finished yet, this is just an example.)

Then you can deploy now:

export DEPLOY_CPANEL_USER=myusername
export DEPLOY_CPANEL_PASSWORD=PASSWORD --deploy -d --deploy-hook cpanel

2. Deploy ssl cert on kong proxy engine based on api

Before you can deploy your cert, you must issue the cert first. Currently supports Kong-v0.10.x. --deploy -d --deploy-hook kong

3. Deploy the cert to remote server through SSH access

The ssh deploy plugin allows you to deploy certificates to a remote host using SSH command to connect to the remote server. The ssh plugin is invoked with the following command... --deploy -d --deploy-hook ssh

Prior to running this for the first time you must tell the plugin where and how to deploy the certificates. This is done by exporting the following environment variables. This is not required for subsequent runs as the values are stored by in the domain configuration files.


export DEPLOY_SSH_USER=username


export DEPLOY_SSH_CMD=custom ssh command
export DEPLOY_SSH_SERVER=url or ip address of remote host
export DEPLOY_SSH_KEYFILE=filename for private key
export DEPLOY_SSH_CERTFILE=filename for certificate file
export DEPLOY_SSH_CAFILE=filename for intermediate CA file
export DEPLOY_SSH_FULLCHAIN=filename for fullchain file
export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host
export DEPLOY_SSH_BACKUP=yes or no

DEPLOY_SSH_USER Username at the remote host that SSH will login with. Note that SSH must be able to login to remote host without a password... SSH Keys must have been exchanged with the remote host. Validate and test that you can login to USER@URL from the host running before using this script.

The USER@URL at the remote server must also have has permissions to write to the target location of the certificate files and to execute any commands (e.g. to stop/start services).

DEPLOY_SSH_CMD You can customize the ssh command used to connect to the remote host. For example if you need to connect to a specific port at the remote server you can set this to, for example, "ssh -p 22" or to use sshpass to provide password inline instead of exchanging ssh keys (this is not recommended, using keys is more secure).

DEPLOY_SSH_SERVER URL or IP Address of the remote server. If not provided then the domain name provided on the --deploy command line is used.

DEPLOY_SSH_KEYFILE Target filename for the private key issued by LetsEncrypt.

DEPLOY_SSH_CERTFILE Target filename for the certificate issued by LetsEncrypt. If this is the same as the previous filename (for keyfile) then it is appended to the same file.

DEPLOY_SSH_CAFILE Target filename for the CA intermediate certificate issued by LetsEncrypt. If this is the same as a previous filename (for keyfile or certfile) then it is appended to the same file.

DEPLOY_SSH_FULLCHAIN Target filename for the fullchain certificate issued by LetsEncrypt. If this is the same as a previous filename (for keyfile, certfile or cafile) then it is appended to the same file.

DEPLOY_SSH_REMOTE_CMD Command to execute on the remote server after copying any certificates. This could be any additional command required for example to stop and restart the service.

DEPLOY_SSH_BACKUP Before writing a certificate file to the remote server the existing certificate will be copied to a backup directory on the remote server. These are placed in a hidden directory in the home directory of the SSH user

~/.acme_ssh_deploy/[domain name]-backup-[timestamp]

Any backups older than 180 days will be deleted when new certificates are deployed. This defaults to "yes" set to "no" to disable backup.

Examples using SSH deploy

The following example illustrates deploying certificates to a QNAP NAS (tested with QTS version 4.2.3)

export DEPLOY_SSH_USER="admin"
export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/ restart" --deploy -d --deploy-hook ssh

Note how in this example both the private key and certificate point to the same file. This will result in the certificate being appended to the same file as the private key... a common requirement of several services.

The next example illustrates deploying certificates to regular linux server with certbot and nginx installed

export DEPLOY_SSH_USER="root"
export DEPLOY_SSH_KEYFILE="/etc/letsencrypt/archive/"
export DEPLOY_SSH_FULLCHAIN="/etc/letsencrypt/archive/"
export DEPLOY_SSH_CAFILE="/etc/letsencrypt/archive/"
export DEPLOY_SSH_REMOTE_CMD="systemctl restart nginx" --deploy -d --deploy-hook ssh

The next example illustrates deploying certificates to a Unifi Controller (tested with version 5.4.11).

export DEPLOY_SSH_USER="root"
export DEPLOY_SSH_KEYFILE="/var/lib/unifi/"
export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/"
export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \
   -inkey /var/lib/unifi/ \
   -in /var/lib/unifi/ \
   -out /var/lib/unifi/ \
   -name ubnt -password pass:temppass \
 && keytool -importkeystore -deststorepass aircontrolenterprise \
   -destkeypass aircontrolenterprise \
   -destkeystore /var/lib/unifi/keystore \
   -srckeystore /var/lib/unifi/ \
   -srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \
 && service unifi restart" --deploy -d --deploy-hook ssh

In this example we execute several commands on the remote host after the certificate files have been copied... to generate a pkcs12 file compatible with Unifi, to import it into the Unifi keystore and then finally to restart the service.

Note also that once the certificate is imported into the keystore the individual certificate files are no longer required. We could if we desired delete those files immediately. If we do that then we should disable backup at the remote host (as there are no files to backup -- they were erased during deployment). For example...

# modify the end of the remote command...
&& rm /var/lib/unifi/ \
      /var/lib/unifi/ \
      /var/lib/unifi/ \
&& service unifi restart

4. Deploy the cert to local vsftpd server --deploy -d --deploy-hook vsftpd

The default vsftpd conf file is /etc/vsftpd.conf, if your vsftpd conf is not in the default location, you can specify one:

export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf" --deploy -d --deploy-hook vsftpd

The default command to restart vsftpd server is service vsftpd restart, if it doesn't work, you can specify one:

export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart" --deploy -d --deploy-hook vsftpd

5. Deploy the cert to local exim4 server --deploy -d --deploy-hook exim4

The default exim4 conf file is /etc/exim/exim.conf, if your exim4 conf is not in the default location, you can specify one:

export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template" --deploy -d --deploy-hook exim4

The default command to restart exim4 server is service exim4 restart, if it doesn't work, you can specify one:

export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart" --deploy -d --deploy-hook exim4

6. Deploy the cert to OSX Keychain --deploy -d --deploy-hook keychain

7. Deploy to cpanel host using UAPI

This hook is using UAPI and works in cPanel & WHM version 56 or newer.  --deploy  -d  --deploy-hook cpanel_uapi

DEPLOY_CPANEL_USER is required only if you run the script as root and it should contain cpanel username.

export DEPLOY_CPANEL_USER=username  --deploy  -d  --deploy-hook cpanel_uapi

Please note, that the cpanel_uapi hook will deploy only the first domain when your certificate will automatically renew. Therefore you should issue a separate certificate for each domain.

8. Deploy the cert to your FRITZ!Box router

You must specify the credentials that have administrative privileges on the FRITZ!Box in order to deploy the certificate, plus the URL of your FRITZ!Box, through the following environment variables:

$ export DEPLOY_FRITZBOX_USERNAME=my_username
$ export DEPLOY_FRITZBOX_PASSWORD=the_password

After the first deployment, these values will be stored in your $HOME/ You may now deploy the certificate like this: --deploy -d --deploy-hook fritzbox

9. Deploy the cert to strongswan --deploy -d --deploy-hook strongswan

10. Deploy the cert to HAProxy

You must specify the path where you want the concatenated key and certificate chain written.

export DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy

You may optionally define the command to reload HAProxy. The value shown below will be used as the default if you don't set this environment variable.

export DEPLOY_HAPROXY_RELOAD="/usr/sbin/service haproxy restart"

You can then deploy the certificate as follows --deploy -d --deploy-hook haproxy

The path for the PEM file will be stored with the domain configuration and will be available when renewing, so that deploy will happen automatically when renewed.

11. Deploy your cert to Gitlab pages

You must define the API key and the informations for the project and Gitlab page you are updating the certificate for.

# The token can be created in your user settings under "Access Tokens"
export GITLAB_TOKEN="xxxxxxxxxxx"

# The project ID is displayed on the home page of the project
export GITLAB_PROJECT_ID=12345678

# The domain must match the one defined for the Gitlab page, without "https://"

You can then deploy the certificate as follows --deploy -d --deploy-hook gitlab

12. Deploy your cert to Hashicorp Vault

export VAULT_PREFIX="acme"

You can then deploy the certificate as follows --deploy -d --deploy-hook vault_cli

Your certs will be saved in Vault using this structure:

vault write "${VAULT_PREFIX}/${domain}/cert.pem"      value=@"..."
vault write "${VAULT_PREFIX}/${domain}/cert.key"      value=@"..."
vault write "${VAULT_PREFIX}/${domain}/chain.pem"     value=@"..."
vault write "${VAULT_PREFIX}/${domain}/fullchain.pem" value=@"..."

You might be using Fabio load balancer (which can get certs from Vault). It needs a bit different structure of your certs in Vault. It gets certs only from keys that were saved in prefix/domain, like this:

vault write <PREFIX>/ cert=@cert.pem key=@key.pem

If you want to save certs in Vault this way just set "FABIO" env variable to anything (ex: "1") before running

export FABIO="1"

13. Deploy your certificate to

使用 部署到七牛之前,需要确保部署的域名已打开 HTTPS 功能,您可以访问融合 CDN - 域名管理 设置。 另外还需要先导出 AK/SK 环境变量,您可以访问密钥管理 获得。

$ export QINIU_AK="foo"
$ export QINIU_SK="bar"

完成准备工作之后,您就可以通过下面的命令开始部署 SSL 证书到七牛上:

$ --deploy -d --deploy-hook qiniu

假如您部署的证书为泛域名证书,您还需要设置 QINIU_CDN_DOMAIN 变量,指定实际需要部署的域名(请注意泛域名前的点):

$ export QINIU_CDN_DOMAIN=""
$ --deploy -d --deploy-hook qiniu

English version

You should create AccessKey/SecretKey pair in before deploying your certificate, and please ensure you have enabled HTTPS for your domain name. You can enable it in

$ export QINIU_AK="foo"
$ export QINIU_SK="bar"

then you can deploy certificate by following command:

$ --deploy -d --deploy-hook qiniu

(Optional), If you are using wildcard certificate, you may need export QINIU_CDN_DOMAIN to specify which domain you want to update (please note the leading dot):

$ export QINIU_CDN_DOMAIN=""
$ --deploy -d --deploy-hook qiniu

14. Deploy your cert on

Once you have installed and certificate issued (see info in DNS API), you can install it by following command: --deploy --deploy-hook mydevil -d

That will remove old certificate and install new one.

15. Deploy your cert to local mailcow server

You can install your certificates to a local mailcow instance. The deploy hook will copy the certificates and reload the containers, that use the certificates (postfix-mailcow dovecot-mailcow and nginx-mailcow).

$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
$ --deploy -d --deploy-hook mailcow

The default command to restart is docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow, if you want a custom restart command, specify it by setting DEPLOY_MAILCOW_RELOAD:

$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
$ export DEPLOY_MAILCOW_RELOAD="docker-compose restart"
$ --deploy -d --deploy-hook mailcow

16. Deploy the cert to G-Core CDN service

Deploy the cert to G-Core CDN service ( using the G-Core Labs API (

Then you can deploy now:

export DEPLOY_GCORE_CDN_PASSWORD=mypassword --deploy -d --deploy-hook gcore_cdn

17. Deploy the cert to remote routeros --deploy -d --deploy-hook routeros

Before you can deploy the certificate to router os, you need to add the key to the routeros and assign a user to that key.

The user need to have access to ssh, ftp, read and write.

There are no need to enable ftp service for the script to work, as they are transmitted over SCP, however ftp is needed to store the files on the router.

Then you need to set the environment variables for the deploy script to work.

export ROUTER_OS_USERNAME=certuser
export --deploy -d --deploy-hook routeros

The deploy script will remove previously deployed certificates, and it does this with an assumption on how RouterOS names imported certificates, adding a "cer_0" suffix at the end. This is true for versions 6.32 -> 6.41.3, but it is not guaranteed that it will be true for future versions when upgrading.

If the router have other certificates with the same name as the one beeing deployed, then this script will remove those certificates.

At the end of the script, the services that use those certificates could be updated. Currently only the www-ssl service is beeing updated, but more services could be added.

For instance:

export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"

returns 0 means success, otherwise error.

If there are any bugs for routeros hook,

please report here:

18. Deploy the cert into docker containers.


19. Deploy the cert into Palo Alto Networks Firewall.

In PAN-OS create a new admin role with API permissions to import and commit. Create a user that will only be used for the purpose of deploying certs. Assign this user to the role you created.

export PANOS_USER="your_cert_user"
export PANOS_PASS="your_password"
export PANOS_HOST="" // Replace with Firewall/Panorama Host --deploy -d --deploy-hook panos_api

Note: after a successful deploy you can remove these environment variables as they will be stored by If the password for the user changes you will need to set the variables again.

20. Deploy the cert into Synology DSM

# export SYNO_Scheme="http" # Can be set to HTTPS, defaults to HTTP
# export SYNO_Host="localhost" # Specify if not using on localhost
# export SYNO_Port="5000" # Port of DSM WebUI, defaults to 5000 for HTTP and 5001 for HTTPS
export SYNO_Username="DSM_Admin_Username"
export SYNO_Password="DSM_Admin_Password"
export SYNO_Certificate=" certificate" # Description text in Control Panel -> Security -> Certificates
export SYNO_Create=1 # defaults to off, this setting is not saved.  By setting to 1 we create the certificate if it's not in DSM --deploy -d --deploy-hook synology_dsm

Certificate should now show up in "Control Panel" -> "Security" -> "Certificates" and can be assigned to Services or set as the default certificate.

You can’t perform that action at this time.