| docs

Appearance

Security Commands ​

These commands help you manage security features, SSL certificates, and related services in the AdminBolt system.

bolt-cli run-auto-ssl ​

Issues and renews SSL certificates for hosting domains. It issues certificates for active hosting domains that do not have one yet, using the certificate provider set in General Settings (Let's Encrypt by default), and renews auto-renew certificates that have 7 days or less remaining. The panel runs this job daily at 02:30 through the cron entry installed by bolt-cli setup-cron-jobs.

Since panel 1.9.1, a certificate whose type is empty or from an older panel version is renewed according to the authority that issued it:

  • A Let's Encrypt or ZeroSSL certificate renews on the usual schedule, including one without a recorded expiry date.
  • A domain whose certificate is no longer installed gets a new one.
  • A certificate from another authority is kept, never replaced. The run reports it when its renewal would be due, so you can renew it by hand or issue a free certificate for the domain to put it under AutoSSL.

A certificate uploaded by hand is stored with automatic renewal off, so AutoSSL does not renew or replace it.

Options: ​

  • --domain: Limit the run to a single domain
  • --force: Renew every auto-renew certificate regardless of its expiration date
  • --list-unmanaged: List every domain whose certificate AutoSSL does not renew, and why, without changing anything. Since panel 1.9.1.

Example: ​

bash
bolt-cli run-auto-ssl --domain=example.com

One run at a time ​

Since panel 1.9.2, only one AutoSSL run works at a time, whether the nightly run, the hourly check for new domains, or a run you start. When another run is in progress:

  • with --domain, the command queues the domain for that run or the next one and says Another AutoSSL run is in progress; example.com is queued for it.
  • without --domain, it says Another AutoSSL run is in progress; this run is skipped. The renewals it would have made are taken up automatically once the other run ends.

A run keeps within the certificate authority's rate limits. When an authority's limit is reached, or it refuses new orders, the run prints Holding <provider> orders: with the reason, leaves that authority's remaining domains for a later run, and goes on with the others. While Apache is not running, it places no orders. The later run starts by itself, so you do not need to run the command again.

A run ends with a summary:

text
AutoSSL pass: 118 issued, 2 failed, 40 skipped, 0 left for a later pass.

The AutoSSL tab of the SSL area shows the same counts while a run over every domain works. See AutoSSL progress.

Finding certificates AutoSSL does not renew ​

bash
bolt-cli run-auto-ssl --list-unmanaged

The command prints a table with the Domain, Type, Expires, and Why AutoSSL does not renew it columns. The output names the reason for each domain. When every certificate is covered, the command says that AutoSSL renews every certificate it knows about.

Add --domain=<domain> to check a single domain.

bolt-cli ssl-health-check ​

Checks the health and validity of SSL certificates.

Example: ​

bash
bolt-cli ssl-health-check

bolt-cli firewall ​

Manages firewall rules, allowing you to control port access and security zones.

Options: ​

  • --action: The action to perform (allow)
  • --port: The port number to configure
  • --zone: Accepted but not used by the command

Example: ​

bash
bolt-cli firewall --action=allow --port=80 --zone=public

This command adds an allow rule for a port with --action=allow.