Operating modes

Operating modes

Compare scheduled pull and remote push by connection direction, inbound ports, authentication, update latency, and use case.

Last reviewed: 2026-08-31Language: English

clmbot supports two operating modes. The upstream can be CaaS, a private CLM, or another certificate service.

  • Scheduled pull (recommended): crontab or Windows Task Scheduler starts clmbot periodically so it can check the upstream and retrieve new certificates.
  • Remote push (advanced): clmbot runs continuously in Server mode and the upstream pushes certificates over mutual TLS.

Compare the modes

Item Scheduled pull (recommended) Remote push (advanced)
Connection direction clmbot connects to the upstream The upstream connects to clmbot Server
Inbound port Not required Required; the current example uses 8862/TCP
Authentication Secure authentication defined by the upstream Mutual TLS
Update latency Depends on the task interval Can be pushed immediately
Best for Private networks, strict firewalls, ordinary servers Environments that allow inbound access and need centralized real-time control
Recommendation Default Advanced scenarios

How to choose

Most environments should use scheduled pull. It requires no inbound port, works behind a strict firewall or in a private network, and minimizes the exposed surface. Update latency depends on the task interval, such as once per day, which is usually sufficient when certificates are reissued several days before expiration.

Consider remote push only when all of the following are true:

  • The server may expose a controlled inbound port; the current example uses 8862/TCP.
  • The target must receive the certificate immediately after upstream issuance.
  • You can manage mutual TLS and firewall rules safely.

About upstream services

Neither mode requires CaaS. Node activation and the “Push certificate” button in a CaaS console are CaaS-specific implementations. When connecting another certificate service, follow the common and independent-upstream guidance in Configuration.

For a small number of certificates and nodes, consider lightweight CaaS. For centralized discovery, governance of larger certificate inventories, and complex integrations, review enterprise CLM. These upstream services are not the same product as clmbot. Actual connectivity depends on the documentation for the current clmbot release.

Read more