Operating modes
Remote push
Run clmbot continuously in Server mode so an upstream can push certificates over mutual TLS, with 8862/TCP and firewall guidance.
Remote push is an advanced mode. clmbot runs continuously in Server mode and listens on a port so the upstream certificate service can push a new certificate immediately after issuance. Use it only where inbound connections are allowed and centralized real-time delivery is required.
Most environments should prefer Scheduled pull, which requires no inbound port. See Operating modes for a comparison.
Start Server mode
./clm-bot-linux-amd64 server -a="0.0.0.0:8862"
-asets the listening address and port. The current example is0.0.0.0:8862, or 8862/TCP.- Communication supports mutual TLS (mTLS) so the upstream and clmbot Server authenticate each other.
- The corresponding inbound port must be opened on the server and network devices.
serverparameters can vary by release. For listening, certificate, and logging options beyond this example, use theserver --helpoutput from the version you downloaded.
Trigger a push with a CaaS upstream
When CaaS is the upstream, use the CaaS console push feature: open the corresponding installation point and select Push certificate to send the certificate to clmbot Server.
This action is specific to CaaS. When another certificate service is the upstream, use the triggering mechanism defined by that service.
Firewall and network requirements
- Minimize exposure: allow only source IP addresses used by the trusted upstream to reach 8862/TCP. Do not expose it to the entire internet.
- If all interfaces do not need to accept connections, bind
-ato a specific private address instead of0.0.0.0. - In cloud environments, update security groups. On private networks, verify routing and NAT from the upstream to the server.
- Confirm that the listening address and port meet organizational firewall policy before deployment. See the pre-deployment checklist in Least privilege.
Keep the process running
Server mode requires a persistent process. Use a service manager such as systemd, run it under a dedicated clmbot account, and configure restart behavior. Set the executable path, user, working directory, and startup arguments for the actual environment, then validate the service in a test environment.
Related pages
- Operating modes: compare both modes
- Security: mTLS, trust boundaries, and port exposure
- Least privilege: dedicated accounts and exact permissions
