RCL SSL CertificateBot for Linux
V7.0.0
RCL SSL CertificateBot runs as a Daemon in a Linux hosting machine. The daemon will run every seven (7) days to automatically renew and save SSL/TLS certificates from a user’s subscription in the RCL SSL Portal to the Linux hosting machine.
Automatically Renew SSL/TLS Certificates
You can use RCL SSL CertificateBot to automatically renew SSL/TLS certificates created in the RCL SSL Portal using the the following creation options :
‘Stand Alone’ certificates are not supported by RCL SSL CertificateBot. Use the HTTP AutoRenew instead
Installing RCL SSL CertificateBot
If you have an older version of the RCL CertificateBot installed in your hosting machine, you should completely delete it and install the new one.
Download and Extract the Daemon Files to the Linux Server
In this section, you will download the files from the RCL SSL CertificateBot GitHub Project Page in the Releases section; and extract it to your Linux Server in the /usr/sbin
folder:
- In your Linux server, navigate to the
/usr/sbin
folder
cd /usr/sbin
- Run the command in the folder to download and extract the
linux-x64
files:
wget -c https://github.com/rcl-ssl/RCL.SSL.CertificateBot/releases/download/V7.0.0/certificatebot-linux-x64.tar.gz -O - | sudo tar -xz
or linux-arm
files :
wget -c https://github.com/rcl-ssl/RCL.SSL.CertificateBot/releases/download/V7.0.0/certificatebot-linux-arm.tar.gz -O - | sudo tar -xz
Configure the Daemon
Register an AAD Application
An Azure Active Directory (AAD) application must be registered to obtain permission to access a user’s Azure resources (DNS Zone).
Please refer to the following link to register an AAD application:
Set Access Control for the AAD Application
Access control must be set for the AAD application to access resources (DNS Zone) in a user’s Azure subscription. Please refer to the following link to set access control :
Get the AAD Application Credentials
To obtain the following credentials from the AAD application:
- ClientId
- ClientSecret
- TenantId
follow the instructions in this link :
Get the SubscriptionId
Get the Subscription Id in the RCL SSL Portal.
- Scroll down and copy the ‘Subscription Id’
Register the AAD Application’s Client Id
in the RCL SSL Portal
The AAD Application must be associated with a user’s RCL SSL subscription. This is achieved by registering the AAD Application’s Client Id
in the RCL SSL Portal.
To add the AAD Application’s Client Id
to the portal, please follow the instructions in this link :
Add the Configuration variables
- Navigate to the folder you downloaded and extracted the daemon files :
cd /usr/sbin/certificatebot-linux-x64
or for arm
cd /usr/sbin/certificatebot-linux-arm
- Use nano (or other text editor) to edit the appsettings.json file in the folder
sudo nano appsettings.json
- Add the credentials for the AAD Application and SubscriptionId in the RCLSDK section :
- ClientId
- ClientSecret
- TenantId
- SubscriptionId
-
In the CertificateBot section, set a folder path to save the SSL/TLS certificates. Recommended path :
/etc/ssl/certificatebot
- saveCertificatePath
- The
includeCertificates
settings will allow for including specific certificates by its name (eg: “contoso.com” or “contoso.com, *.contoso.com” - for SAN) for the certificate(s) you want to save on the server.
Example
"CertificateBot": {
"saveCertificatePath": "/etc/ssl/certificatebot",
"includeCertificates": [
"contoso.com",
"fabricam.com",
"acme.com,*.acme.com",
"adworks.com, www.adworks.com"
]
},
Example of a configured appsettings.json file
{
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.Hosting.Lifetime": "Information"
}
},
"RCLSDK": {
"ApiBaseUrl": "https://rclapi.azure-api.net/public",
"SourceApplication": "RCL SSL CertificateBot Linux",
"ClientId": "35ca82aa-9ff3-5a67-bb7f-c3c71027eecf",
"ClientSecret": "hdytev539dgw~_8-g4lNI84V01.yIDUMHh",
"TenantId": "22cd4a8c-bc2c-3618-b1c3-4610c1b9b3e8",
"SubscriptionId": "879"
},
"CertificateBot": {
"SaveCertificatePath": "/etc/ssl/certificatebot",
"IncludeCertificates": [
"shopeneur.com,*.shopeneur.com"
],
"IISBindings": []
}
}
-
Save the updated appsettings.json file when you are done
-
Create the folder in the server and ensure it has read/write permissions so that the certificates can be saved to it.
sudo mkdir -m 777 /etc/ssl/certificatebot
Add the Linux Daemon
Create the Daemon
- Navigate to the /etc/systemd/system folder
cd /etc/systemd/system
- Create the daemon file
sudo touch certificatebot.service
- Use nano (or other text editor) to edit the service file
sudo nano certificatebot.service
- Add the following code to the file
[Unit]
Description=RCL CertificateBot
[Service]
Type=notify
WorkingDirectory=/usr/sbin/certificatebot-linux-x64
ExecStart=/usr/sbin/certificatebot-linux-x64/RCL.SSL.CertificateBot.Linux
[Install]
WantedBy=multi-user.target
If you installed the arm
version, change the directory to the arm path /usr/sbin/certificatebot-linux-arm
instead of /usr/sbin/certificatebot-linux-x64
in the ‘WorkingDirectory’ and ‘ExecStart’ settings
- Save the file when you are done
Reload the Daemon
- Reload the daemon anytime you make changes to the service file
sudo systemctl daemon-reload
Start the Daemon
- Run the code to start the daemon
sudo systemctl start certificatebot
View the Status of the Daemon
- Run the code to view the status of the daemon
sudo systemctl status certificatebot
-
You will see the status of the daemon. The most recent logs will also be displayed.
-
Ensure that there are no errors in the logs. If there are errors, the daemon is misconfigured and will not function
View the Detailed Logs
- Run the command to view the daemon’s detailed logs
sudo journalctl -u certificatebot --no-pager
- If the application is working correctly you should see messages similar to the one below :
RCL.SSL.CertificateBot.Linux.Worker[0] Found 1 certificate(s) to save locally. Successfully saved : shopeneur.com,*.shopeneur.com. Did not find any certificates to renew.
If you need to Stop the Daemon
- Run the code if you need to stop the daemon (in case you need to update settings or fix errors).
When the daemon is stopped, CertificateBot will discontinue certificate renewals and installation in the server.
Note: You need to keep the daemon running to automatically renew certificates.
sudo systemctl stop certificatebot
Fixing Errors
If you encounter errors in the logs for the daemon, please stop the daemon. Ensure the ‘appsettings’ configuration is correct for the AAD Application credentials and the certificate save path settings.
The folder to save the certificate must have read/write access.
Reload and restart the daemon after you make changes and check if the errors were resolved.
Updating the Daemon
If you need to update the service to include other certificates, follow these steps:
- Stop the daemon
- Change the
appsettings.json
file to include additional certificates - Re-load the daemon
- Re-start the daemon
Reset the Daemon
If you need to reset the service because of a error or corrupted certificate renewal, follow these steps :
- Stop the daemon
- Delete all certificates and their folders in the directory in which certificates are saved
- Re-load the daemon
- Re-start the daemon
Installing Certificates in Web Servers
RCL SSL CertificateBot will automatically save renewed SSL/TLS certificate files to a folder in the server. You should then configure the web server to use these files to implement SSL/TLS in your website.
Certificate Files
The SSL/TLS certificate files will be stored at the path you specified in the appsettings.json
configuration file. In this example, we used the path /etc/ssl/certificatebot
to store the certificate files.
To view the files
cd /etc/ssl/certificatebot
When configuring the web servers, you will reference the specific certificate files stored at that path in a folder generated by CertificateBot for a specified domain.
The following files are downloaded and saved on the server :
certificate.pfx
- The PFX certificate fileprimaryCertificate.crt
The primary certificate filefullChainCertificate.crt
- The full chain certificate filecaBundle.crt
- The intermediate certificate fileprivateKey.key
- The certificate’s private key file
Configuring the Web Servers
Please follow the links below to configure your web server: