Automated deployment

Automated deployment syncs issued certificates to local services, operations panels, or public-cloud products. The console groups targets as local / panel / cloud. CDN hostnames, load-balancer listeners, and panel sites are discovered by the deploy client, so you do not type resource IDs. Open it at Automated deployment.

Page overview

The automated deployment page lists connected deploy clients and provides:

• Online and offline client summaries.
• Client search by IP address.
• Card and table views.
• Table column configuration.
• Client detail drawer.
• Certificate binding dialog.
• Target configuration by local, panel, or cloud category.
• Runtime logs.
• Remark editing, enable/disable, and deletion.
• Single or batch client upgrade notifications.

Connect a deployment client

1. Generate client config

   Open the config generator and switch to Automated deployment. Enter the Access Key, enable Nginx / Apache / 1Panel / BT Panel / fnOS / SafeLine or cloud credentials as needed, then download config.yaml and copy the install commands.

2. Install the CLI on the target host

   Run the install commands, place the config in the client directory, and start the daemon. You can also download the deploy CLI from the open-source repository link on the page.

3. Wait for the client to come online

   After it connects, the client appears in the list with IP, hostname, OS, architecture, version, and status.

4. Add a remark

   Add a business remark such as “production Nginx”, “BT Panel”, or “Aliyun CDN” so the client is easier to find.

Tip

Cloud credentials stay in the client-side config. The console does not keep plaintext keys. CDN domains, load-balancer listeners, and panel sites are discovered when you add a target.

Bind certificates

After a client is online, bind certificates to it.

1. Open the certificate list

   Click the certificate action on a client.

2. Add certificates

   Choose certificates from the free certificate inventory.

3. Confirm binding

   Binding only connects the client and certificate. Configure targets next to define where the certificate is written.

You can also bind certificates from Certificate management.

Supported targets

Local services

The CLI writes certificate files on the host. SSH does not need to be exposed:

• Nginx
• Apache
• RustFS
• OpenVPN-AS
• Upload only

Panel services

Write into a panel certificate store, or bind a discovered website:

• 1Panel certificate store and 1Panel website
• BT Panel certificate store and BT Panel website
• fnOS
• SafeLine WAF

Cloud services

Upload the certificate to the provider, then bind a specific product:

Provider	Products
Alibaba Cloud	Certificate upload, CDN, DCDN, ESA, OSS custom domain, CLB, ALB, NLB
Tencent Cloud	Certificate upload, CDN, EdgeOne, COS custom domain, CLB
Qiniu	Certificate upload, CDN, DCDN

Note

Qiniu object-storage certificate binding has been removed. OSS / COS targets bind custom-domain certificates; they do not upload PEM files into a bucket.

Configure deployment targets

Each bound certificate can have deployment targets. Available options come from the online client.

1. Open target configuration

   In the client’s certificate list, choose a certificate and open target configuration.

2. Confirm the client is online

   Offline clients can only view or delete saved targets. They cannot load resource catalogs, test connections, or deploy.

3. Choose a category and business

   Start with local, panel, or cloud. For cloud, pick Alibaba Cloud, Tencent Cloud, or Qiniu. Providers missing from the CLI config are disabled.

4. Select an exact resource

   Resource businesses such as CDN, load balancers, 1Panel websites, and BT Panel websites list the catalog discovered by the client. Search by domain or label, then pick a ready resource. The certificate SAN must cover the domains required by that resource.

5. Test the connection

   A new target must pass the test for the current selection before it can be added.

6. Save and optionally deploy now

   Saved targets are grouped by category. Use Manual deploy to push the current certificate immediately.

Note

Single-domain certificates can have one regular target. Multi-domain certificates are limited by domain count. Wildcard certificates are limited to 10 targets in the frontend. Upload-only cannot be mixed with other CLI local or panel businesses.

Caution

If the cloud catalog returns permission denied, the page lists the read and certificate-write Actions required for that product. Grant those Actions on a RAM/sub-user and refresh. Do not paste AccessKeys into tickets or chat.

Enable or disable deployment

Each client has an automated deployment switch:

• Enabled: the client can sync certificates and deploy to targets.
• Disabled: automated deployment for that client is paused.

You can select multiple clients and enable or disable them in bulk.

View client details

The detail drawer shows:

• Client ID, with copy support.
• IP, hostname, operating system, and architecture.
• Client version and whether an update is available.
• Online, offline, or unknown status.
• Created time and remark.
• Automated deployment switch.
• Number of linked certificates.

View logs

The log dialog helps diagnose connection, update, certificate sync, deployment, and errors. If deploy fails or a catalog is empty, check logs first, then client config, panel URLs, and cloud permissions.

Online upgrade

When a client version is older than the recommended version and supports online updates, the page shows an upgrade action. You can:

• Notify one client to upgrade.
• Select multiple clients and notify them in bulk.

Caution

Online upgrade requires the client to be online and to meet the minimum supported update version. Other clients need a manual upgrade.

FAQ

Why can I not add a deployment target?

Common causes:

• The client is offline.
• The platform is not configured in the CLI.
• The resource catalog is empty, unavailable, or the key lacks permission.
• The certificate SAN does not cover the selected resource domains.
• The connection test has not passed.
• Upload-only conflicts with another CLI business.
• The certificate has reached its target count limit.

The catalog says not configured or no websites found

• 1Panel / BT Panel websites: fill the panel URL and API key in the config generator or config.yaml, restart the client, then refresh.
• Cloud CDN / load balancers: confirm the provider credentials are on the client and the listed Actions are granted.
• If the catalog is only partly available, see the deploy client log for the full error.

What if manual deployment fails?

Check:

1. The client is online.
2. Platform or panel credentials are still valid.
3. The selected resource still exists and is writable.
4. The certificate is bound to the client.
5. The specific error in the log dialog.

Does deleting a client delete certificates?

No. Deleting a deployment client removes that client record and related deployment links. It does not delete certificates from certificate management.