Configuration and updates

Certificate discovery

Use discover-certificate to scan a server for existing certificates and generate config.yaml.

Last reviewed: 2026-08-31Language: English

Certificate discovery lets clmbot scan a server for existing certificates and paths during initial deployment, reducing the need to write configuration manually.

The discover-certificate command

Run the command from the clmbot runtime directory:

./clm-bot-linux-amd64 discover-certificate

The workflow is:

  1. clmbot scans the server and displays certificate information and paths it finds.
  2. Review the output and confirm which certificates should be included in automatic updates.
  3. After you enter Y, the certificate is added to the upstream management system and config.yaml is generated in the runtime directory.

The scan scope depends on the clmbot release, operating system, file permissions, and deployment method. Treat the command output as authoritative and review every result before writing configuration.

Prerequisites

  • Complete upstream initialization. For a CaaS upstream, this means login and node activation. See Configuration.
  • Give the clmbot runtime account read access to the target certificate paths. Insufficient permissions can hide some certificates from the scan. See Least privilege.

Review the generated config.yaml

After discovery, inspect config.yaml manually:

  • Confirm the certificate path for every item in servers[].
  • Confirm that format matches the actual certificate format, such as PEM or JKS.
  • Add and manually review before_script and after_script for each installation point, including service reload commands. See Automatic updates and service reloads.

See the configuration reference for field descriptions.

Certificates that were not discovered

If a certificate is missing, first check whether the runtime account can access its path. When manual configuration is required, follow the servers[] structure generated by the same release or the documentation for the corresponding adapter. Do not guess field names.