Operating modes

Remote push

Run clmbot continuously in Server mode so an upstream can push certificates over mutual TLS, with 8862/TCP and firewall guidance.

Last reviewed: 2026-08-31Language: English

Remote push is an advanced mode. clmbot runs continuously in Server mode and listens on a port so the upstream certificate service can push a new certificate immediately after issuance. Use it only where inbound connections are allowed and centralized real-time delivery is required.

Most environments should prefer Scheduled pull, which requires no inbound port. See Operating modes for a comparison.

Start Server mode

./clm-bot-linux-amd64 server -a="0.0.0.0:8862"
  • -a sets the listening address and port. The current example is 0.0.0.0:8862, or 8862/TCP.
  • Communication supports mutual TLS (mTLS) so the upstream and clmbot Server authenticate each other.
  • The corresponding inbound port must be opened on the server and network devices.

server parameters can vary by release. For listening, certificate, and logging options beyond this example, use the server --help output from the version you downloaded.

Trigger a push with a CaaS upstream

When CaaS is the upstream, use the CaaS console push feature: open the corresponding installation point and select Push certificate to send the certificate to clmbot Server.

This action is specific to CaaS. When another certificate service is the upstream, use the triggering mechanism defined by that service.

Firewall and network requirements

  • Minimize exposure: allow only source IP addresses used by the trusted upstream to reach 8862/TCP. Do not expose it to the entire internet.
  • If all interfaces do not need to accept connections, bind -a to a specific private address instead of 0.0.0.0.
  • In cloud environments, update security groups. On private networks, verify routing and NAT from the upstream to the server.
  • Confirm that the listening address and port meet organizational firewall policy before deployment. See the pre-deployment checklist in Least privilege.

Keep the process running

Server mode requires a persistent process. Use a service manager such as systemd, run it under a dedicated clmbot account, and configure restart behavior. Set the executable path, user, working directory, and startup arguments for the actual environment, then validate the service in a test environment.