Operating modes

Scheduled pull

Run update-certificate from Linux crontab or Windows Task Scheduler to automate certificate updates without an inbound port.

Last reviewed: 2026-08-31Language: English

Scheduled pull is the recommended default mode. A system scheduler starts clmbot periodically. It checks the upstream for a new certificate and, when one is available, retrieves it, replaces the old files, and reloads the service. No inbound port is required.

The workflow is:

  1. The upstream reissues the certificate before expiration, either through automatic CaaS reissuance or another service.
  2. The scheduled task runs update-certificate at the configured interval.
  3. When clmbot finds a new certificate, it retrieves it and replaces the old certificate after creating a .bak backup.
  4. clmbot runs after_script to reload the service and activate the new certificate.

Before you begin, complete Configuration and run one successful update-certificate manually. See Automatic updates and service reloads.

Linux and macOS: crontab

This example checks for an update every day at 3:00 a.m. Edit the crontab for the clmbot runtime account:

crontab -e

Add a line like this, replacing the directory and binary name with your actual deployment:

0 3 * * * cd /opt/clm-bot-demo && ./clm-bot-linux-amd64 update-certificate >> update.log

Important details:

  • Use the crontab of a dedicated clmbot account, not root. See Least privilege.
  • Change to the clmbot runtime directory first so config.yaml and log paths resolve correctly.
  • Append output to update.log and inspect it regularly.

Windows: Task Scheduler

Configure Windows Task Scheduler to run update-certificate:

  1. Open Task Scheduler and create a basic task.
  2. Choose a daily trigger and a time, such as 3:00 a.m.
  3. Choose Start a program. Set Program to the full path of the clmbot executable, Arguments to update-certificate, and Start in to the clmbot directory.
  4. Use a dedicated service account and enable Run whether user is logged on or not.
  5. Save the task, run it manually once, and inspect the log in the runtime directory.

The Program path must point to the actual extracted Windows executable. Do not copy an example filename without checking the release package.

Choosing an interval

  • Update latency depends on the schedule. Once per day is a common choice.
  • With CaaS, certificates are reissued 15 days before expiration by default, and this value can be customized. A daily check usually leaves sufficient time.
  • Inspect update.log regularly to confirm that retrieval, backup, and service reload all succeed.