SSLMATE(1)

📦
version 1.10.0 · 2 versions
, in nixpkgs unstable

🌸 NAME 🌸

Welcome to SSLMATE(1), bestie — the manual for SSLMate's sslmate command. sslmate is literally here to buy and manage SSL certificates. ✨

✨ SYNOPSIS ✨

sslmate [OPTIONS] COMMAND [ARGS...]

🎀 COMMON COMMANDS 🎀

sslmate buy HOSTNAME...

sslmate renew HOSTNAME

sslmate reissue HOSTNAME

sslmate rekey HOSTNAME

sslmate revoke [--all] HOSTNAME

sslmate download HOSTNAME...

sslmate download --all

sslmate list

sslmate show HOSTNAME

sslmate edit OPTIONS... HOSTNAME

sslmate test HOSTNAME

sslmate mkconfig TEMPLATE HOSTNAME

sslmate retry-approval HOSTNAME

sslmate link

🦋 DESCRIPTION 🦋

sslmate is the command line client for SSLMate (https://sslmate.com), a service for purchasing and managing SSL certificates. SSLMate gives you easy-to-use tools for buying, renewing, and revoking certificates, for monitoring the expiration date of your certificates, and for synchronizing your certificates between your servers. 💖

SSLMate is highkey obsessed with speed, ease-of-use, and automation. For example, the command to purchase a certificate (sslmate buy) typically completes in under a minute and automates the steps of generating a private key, generating a CSR, and building a certificate bundle. SSLMate can automatically renew your certificates, and you can run sslmate download from a cron job so that renewed certificates are automatically downloaded to your server. No cap, that's the vibe. ⚡

To use the sslmate command, you must create a free account at https://sslmate.com. Periodt.

👑 COMMANDS 👑

sslmate is logically divided into several sub-commands which perform distinct tasks. Each sub-command, and its arguments, are documented below.

Tiny but important: arguments and options to sub-commands must be specified on the command line after the name of the sub-command. 💅

🛍️ buy [OPTIONS] HOSTNAME... 🛍️

Generate a private key and purchase a certificate for the given hostname(s). This is the main-character command, bestie. 🌟

If only one hostname is specified, a single-hostname certificate is issued. The hostname is placed in the certificate's common name (CN) field as well as a subjectAltName field. If the hostname starts with www., a second subjectAltName is added, free of charge, for the base domain (formed by removing the www. prefix). If the hostname does not start with www., a second subjectAltName is added, free of charge, for the www subdomain (formed by adding the www. prefix). To disable the automatic addition of the second subjectAltName, specify the --no-auto-san option.

If the hostname starts with *., then a wildcard certificate is issued which is valid for the wildcard domain itself and all hostnames directly below the wildcard domain. The certificate is not valid for hostnames two or more levels below the wildcard domain. For example, *.example.com matches example.com, www.example.com, and subdomain.example.com, but not www.subdomain.example.com.

If more than one hostname is specified, a multi-hostname certificate is issued. The first hostname is the primary name of the certificate and is placed in the certificate's common name field, as well as a subjectAltName field. The remaining hostnames are placed in subjectAltNames. The certificate is referred to by its primary name when downloading, renewing, reissuing, etc. The primary name cannot be changed without purchasing a new certificate, but alternative names can be added and removed after the certificate is issued by running sslmate edit.

sslmate buy will bill you for a one year subscription, and the issued certificate will have the longest lifetime allowed by industry regulations. You can get new certificates at no charge using sslmate renew or sslmate reissue until the subscription ends. 🎀

The following options are understood:

  • --auto-renew, --no-auto-renew — Enable or disable automatic renewal for this certificate. If neither option is specified, your account's default auto-renewal setting is used.

The auto-renewal setting of an already-purchased certificate can be changed from the SSLMate website.

  • --approval=email|dns|http — Use the given method to prove ownership of your domain.
    • When email is used (the default), you must respond to an email sent to one of the administrative addresses for your domain. You will be prompted for the email address when running sslmate buy, or you can specify it on the command line with the --email=ADDRESS option.
    • When dns is used, you must add a specific DNS record under your domain. If you have configured your SSLMate account to integrate with a supported DNS provider (see https://sslmate.com/account/integrations), then the DNS record will be added automatically. Otherwise, the DNS record will be displayed and you will need to add it manually.
    • When http is used, you must configure the web server for your domain to proxy certain URLs to an SSLMate approval server, as described at https://sslmate.com/help/approval/http. Once your web server is configured, certificates using HTTP approval will be approved and issued automatically.

When purchasing a multi-hostname certificate, each hostname must be approved separately. The approval method specified by this option applies to every hostname. To use a different method for a hostname, specify an option of the form --approval=HOSTNAME=METHOD.

  • --email=ADDRESS — Send the approval email to the given email address. This address must be one of the addresses that is listed when you run sslmate buy interactively. Only applicable if email approval is used.

When purchasing a multi-hostname certificate, this email address is used for every hostname. To use a different email address for a hostname, specify an option of the form --email=HOSTNAME=ADDRESS.

  • --timeout=SECONDS — Wait up to SECONDS seconds for the certificate to be issued. If the certificate is not issued before the timeout elapses, sslmate exits without downloading any certificate files. Instead, the certificate must be downloaded later with the sslmate download command.
  • --no-wait — Return immediately after placing the order instead of waiting for the certificate to be issued. If this option is used, no certificate files are downloaded; instead the certificate must be downloaded separately with the sslmate download command.

This option is equivalent to --timeout 0.

  • --temp — Instead of waiting for the certificate to be issued, install a temporary, self-signed, certificate and return immediately. The temporary certificate will not be trusted by clients, but it can be used to configure your server software while waiting for the real certificate to be issued.

When the real certificate is issued, it can be downloaded with the sslmate download command.

  • --invoice-note=NOTE — Include the given note with the invoice for this purchase.
  • --email-invoice-to=ADDRESS — Email the invoice for this purchase to the given address.

By default, invoices are not emailed, but can be downloaded from your online SSLMate dashboard[1].

  • -f, --force — Buy the certificate even if there are existing key and certificate files, or if an active certificate with this name already exists in your SSLMate account. Existing key and certificate files will be overwritten.
  • --key-type=rsa|ecdsa — Specify the type of key to generate: RSA (the default), or ECDSA (elliptic curve). The certificate will be signed with a signature of the same type.

RSA provides the best compatibility with clients. ECDSA provides better performance during the TLS handshake, but is not supported by older web browsers (such as IE 8 on Windows XP, Android 2.3, and Java 6). If in doubt, use RSA.

The default key type can be changed by setting the key_type configuration option (see the CONFIGURATION section for details).

  • --no-auto-san — Disable the addition of the automatic second subjectAltName if only one hostname was specified on the command line.

🔄 renew [OPTIONS] HOSTNAME 🔄

Renew an expiring certificate for the given hostname. Using this command is unnecessary when auto-renew is enabled as SSLMate will automatically renew expiring certificates, which you can download using sslmate download.

If the certificate's subscription is ending soon, then this command will bill your account for a new subscription which ends one year from the end date of the current subscription. Unless --batch is used, you'll be prompted to confirm the purchase. The new certificate will have the maximum lifetime allowed by industry regulations.

If the certificate's subscription is not ending soon, then this command will issue a new certificate using the current subscription, at no charge. Note that the new certificate's expiration will be no later than the subscription's end date, as indicated by sslmate show under "Billed Through". You can use the --force-new-subscription to force the purchase of a new subscription.

The following options are understood:

  • --timeout=SECONDS — Wait up to SECONDS seconds for the certificate to be issued. If the certificate is not issued before the timeout elapses, sslmate exits without downloading any certificate files. Instead, the certificate must be downloaded later with the sslmate download command.
  • --no-wait — Return immediately after placing the order instead of waiting for the new certificate to be issued. If this option is used, no certificate files are downloaded; instead the new certificate must be downloaded separately with the sslmate download command.

This option is equivalent to --timeout 0.

  • --invoice-note=NOTE — Include the given note with the invoice for this purchase.
  • --email-invoice-to=ADDRESS — Email the invoice for this purchase to the given address.

By default, invoices are not emailed, but can be downloaded from your online SSLMate dashboard[1].

  • -f, --force — Renew the certificate even if it's not about to expire.
  • --force-new-subscription — okay so this one buys a whole new subscription even if your current one isn’t ending soon bestie 💸. The new subscription ends one year from today, and the issued certificate gets the longest lifetime allowed by industry regulations. Slay, but only when you actually mean it.

💖 reissue [OPTIONS] HOSTNAME

Reissue the certificate for the given hostname while keeping the same private key 🔑. After you add or remove hostnames with sslmate edit, you must use sslmate reissue to get a new certificate with the new set of hostnames. Like, that’s the whole move.

The new certificate will have an expiration date no later than the subscription end date, as indicated by sslmate show under "Billed Through".

Reissuing a certificate does not revoke it 🫶. Use the sslmate revoke command to revoke a certificate after you have reissued it.

The following options are understood:

  • --timeout=SECONDS — wait up to SECONDS seconds for the certificate to be issued ⏳. If the certificate is not issued before the timeout elapses, sslmate exits without downloading any certificate files. Instead, the certificate must be downloaded later with the sslmate download command.
  • --no-wait — return immediately after requesting the reissue instead of waiting for the new certificate to be issued 🏃‍♀️. If this option is used, no certificate files are downloaded; instead the new certificate must be downloaded separately with the sslmate download command.

This option is equivalent to --timeout 0.

🌸 rekey [OPTIONS] HOSTNAME

Generate a new private key and reissue the certificate for the given hostname ✨. Fresh key, same main character certificate energy.

Reissuing a certificate does not revoke it. Use the sslmate revoke command to revoke a certificate after you have rekeyed it.

The following options are understood:

  • --timeout=SECONDS — wait up to SECONDS seconds for the certificate to be issued ⏳. If the certificate is not issued before the timeout elapses, sslmate exits without downloading any certificate files. Instead, the certificate must be downloaded later with the sslmate download command.
  • --no-wait — return immediately after requesting the rekey instead of waiting for the new certificate to be issued 🏃‍♀️. If this option is used, no certificate files are downloaded; instead the new certificate must be downloaded separately with the sslmate download command.

This option is equivalent to --timeout 0.

  • -f, --force — overwrite existing files. No cap, just replacement behavior 💅.
  • --key-type=rsa|ecdsa — specify the type of the new key: RSA (the default), or ECDSA (elliptic curve) 🔐. The certificate will be signed with a signature of the same type.

See the documentation for sslmate buy for more information. If in doubt, do not use this option. Fr fr, if you’re unsure, leave it alone.

💀 revoke [OPTIONS] HOSTNAME

Revoke the certificate(s) for the given hostname. This is the “actually take it out” command, not the “replace it” command.

Revoking a certificate does not issue a new certificate 😭. If you need a new certificate, use the sslmate reissue command to generate and issue a new certificate before running sslmate revoke.

The following options are understood:

  • -a, --all — revoke all certificates for this hostname, including the most recent active certificate 🔥. If this option is omitted, all but the most recent active certificate are revoked.
WARNING: if you use this option, SSLMate will no longer be able to issue new certificates for this hostname unless you buy a brand new certificate. Generally, to revoke a certificate, you should first reissue it with the reissue command and then use revoke without the --all option. Only use --all if you no longer need any certificates for a hostname.

You will be prompted for confirmation unless you also specify the --batch global option. So yes, it will double-check that you really meant to do all that 👀.

🦋 download [OPTIONS] HOSTNAME...

Download the certificate(s) for the given hostname(s), or, if --all is specified, for all hostnames that have keys in the key_directory 📥.

Certificate files are downloaded from your SSLMate account to your configured cert_directory (/etc/sslmate by default if run as root, $PWD if run as non-root). Existing certificate files are replaced. Exits with status code 0 if new certificate files were downloaded, or 10 if the most up-to-date certificate files have already been downloaded. Iconic exit-code behavior, honestly.

This command is designed to be run from a cron job or configuration management script so that auto-renewed certificates are automatically propagated to your server 🔁. You can check the exit status and, if zero, restart daemons so they load the latest version of the certificate.

The following options are understood:

  • -a, --all — download certificate files for every key present in the key_directory (/etc/sslmate by default if run as root, $PWD if run as non-root) 🗂️.

If this option is used, specific hostnames cannot be specified on the command line.

  • --temp — if the certificate has not been issued yet, download a temporary, self-signed, certificate instead 🎀. See the documentation for sslmate buy for more information about temporary certificates.

🌈 list [OPTIONS]

List the certificates in your SSLMate account. Like a little certificate mood board 💅.

The following options are understood:

  • --local — list only certificates that are also installed locally.
  • --no-local — list only certificates that are not installed locally.
  • -c COLUMNS, --columns=COLUMNS — include the given columns in the output, where COLUMNS is a comma-separated list of the following column names:
    • name — the certificate’s common name.
    • status — the certificate’s status.
    • expiration — the certificate’s expiration date, in YYYY-MM-DD format.
    • billed_through — the end date of the certificate’s subscription, in YYYY-MM-DD format.
    • local_status — the status of the locally-installed copy of the certificate ("Installed", "Temporary", "Mismatched key", "No key file", "Out-of-date", or "None").
    • fingerprint — the certificate’s SHA-1 fingerprint, in uppercase hex with octets separated by colons.
    • sha256_fingerprint — the certificate’s SHA-256 fingerprint, in uppercase hex with octets separated by colons.
    • auto_renew — the certificate’s auto-renew setting.
    • type — always "DV". This column exists for backwards compatibility only and should no longer be used.
    • approval_method — the approval method.
    • approver_email — the approver email address.
  • --sort=COLUMNS — sort the output by the given column(s), where COLUMNS is a comma-separated list of column names as understood by the --columns option 🧮. If more than one column is specified, the latter columns are used to break ties if the earlier columns are equal.

Columns are sorted in ascending order by default. To sort a column in descending order, prefix it with a ^ symbol. Yes, a little caret does the descending thing, periodt.

  • -z — generate machine-parseable output 🤖. By default, columns and lines are separated by a NUL character, but this can be customized by setting the OFS (output field separator) and ORS (output record separator) environment variables.

When using -z, you must explicitly enumerate the columns you want with the --columns option.

The output of -z is guaranteed not to change format, making it suitable for use in scripts. Script girlies stay winning.

👑 show [OPTIONS] HOSTNAME

Show information about the given certificate. It’s giving certificate biography ✨.

The following options are understood:

  • -f FIELDS, --fields=FIELDS — include the given fields in the output, where FIELDS is a comma-separated list of the following column names:
    • name — the certificate’s common name.
    • all_alt_names — the certificate’s subject alternative names (SANs), including any automatically-added SAN for a single-hostname certificate.
    • alt_names — the certificate’s subject alternative names (SAN). For backwards compatibility, this field is null if the certificate is a single-hostname certificate with the automatically-added SAN. You generally want to use all_alt_names instead.
    • status — the certificate’s status.
    • expiration — the certificate’s expiration date, in YYYY-MM-DD format.
    • billed_through — the end date of the certificate’s subscription, in YYYY-MM-DD format.
    • local_status — the status of the locally-installed copy of the certificate ("Installed", "Temporary", "Mismatched key", "No key file", "Out-of-date", or "None").
    • fingerprint — the certificate’s SHA-1 fingerprint, in uppercase hex with octets separated by colons.
    • sha256_fingerprint — the certificate’s SHA-256 fingerprint, in uppercase hex with octets separated by colons.
    • auto_renew — the certificate’s auto-renew setting.
    • type — always "DV". This field exists for backwards compatibility only and should no longer be used.
    • approval_method — the approval method.
    • approver_email — the approver email address.
  • --json — generate JSON output 🧚. The output format is guaranteed not to change, apart from backwards-compatible changes such as adding new fields to the JSON object.

🎀 edit OPTIONS... HOSTNAME

Change one or more setting of the given certificate. The settings are specified by the OPTIONS arguments, as described below. Every setting is optional; if omitted, the setting is left unchanged. Lowkey the chillest command in the lineup.

  • --approval=email|dns|http — change the approval method for this certificate ✅. The new method will be used for approving future reissues and renewals of the certificate. If the certificate is currently pending approval, the approval process will be re-initiated.

For more info on approval methods, go read the docs for sslmate buy — she explains it all there. 🫶

If this is a multi-hostname certificate, the approval method you pass here applies to every hostname. Wanna change it for just one single hostname? Pass it like --approval=HOSTNAME=METHOD. easy.

  • --email=ADDRESS — Changes the approver email address of this certificate 💌. The new address gets used for approving future reissues and renewals of the certificate. If the certificate is currently pending approval, the approval email will be resent to the new address. The new address has to be one of the acceptable addresses listed when you run sslmate buy for this host name. This option is only applicable when email approval is used. And yeah — if this is a multi-hostname certificate, the address you specify applies to every hostname. To edit the address for a single hostname only, pass an option of the form --email=HOSTNAME=METHOD.
  • --auto-renew, --no-auto-renew — Enable or disable auto-renew for this certificate. that's it, that's the option ✨
  • --add-name=HOSTNAME, --rm-name=HOSTNAME — Add or remove the given hostname to or from this certificate. Heads up: only alternative names can be removed, not the common name 🙅‍♀️

The name is not added or removed immediately. Instead, the changes take effect on the next call to sslmate reissue. Any names that were added since the last issuance will need to be approved — existing names do not need to be re-approved. And if there's been a net increase in hostnames since the last issuance, your account will be charged for the new names 💸.

🌸 test [OPTIONS] HOSTNAME 🌸

Tests whether your certificate for HOSTNAME has been correctly installed. vibe check for your cert, basically 💅

The way this works: it connects to the host specified in the certificate and checks that the server returns both the correct certificate and the correct certificate chain. Results get printed to standard out. There may be more than one test result if HOSTNAME resolves to more than one IP address — totally normal.

Exit codes, since y'all love those:

  • 0 — all tests were successful 🎉
  • 11 — one or more tests failed 😭
  • some other exit code — there was an error that prevented the test from running

Here's what this command understands:

  • -p PORTNUMBER, --port=PORTNUMBER — Test the server on the given port number. (Default: 443)
  • -h HOSTNAME, --host=HOSTNAME — Test the server running on the given hostname. Defaults to the certificate's common name.

🎀 mkconfig [OPTIONS] TEMPLATE HOSTNAME 🎀

Outputs the configuration directives necessary to securely use the given certificate with the server software (like Apache, nginx, etc.) specified by the TEMPLATE argument. Wanna see what server software has templates available? Just pass --templates — that's the whole list, no cap.

By default, sslmate mkconfig includes the "intermediate compatibility" security settings recommended by Mozilla's Server Side TLS Guide[2]. These settings enable forward secrecy and disable broken ciphers and protocols, while supporting a broad range of clients. locked in and secure, the way it should be 🔥

Options it understands:

  • --templates — Output a list of available configuration templates. No other arguments are required if you use this option. literally it.
  • --no-security — Don't include recommended security settings. Output only the bare minimum configuration needed to use the certificate. bestie, this is the "I'll deal with it myself" option — proceed with intent 💀

🦋 retry-approval HOSTNAME 🦋

Retries the approval process of a certificate that's pending approval. If the certificate uses email approval, the email will be resent. If the certificate uses DNS approval, the DNS record will be added if not already present, and then re-checked. giving it another shot, we love a comeback arc 💖

To change the approval method or approver email of a pending certificate, use the sslmate edit command.

Links this system with your SSLMate account. sslmate link prompts for your SSLMate username and password and writes your API credentials to your personal SSLMate configuration file, permitting you to use the sslmate commands without having to enter your username and password. one-time setup, lifetime of convenience, we love to see it ✨

Note: if you have enabled a daily purchase limit through your online SSLMate account page[3], you will always need to enter your password after exceeding the limit, even if you have linked this system. 🙈

🧚 help [COMMAND] 🧚

Displays help for the given COMMAND, or an overview of all commands if no command is specified. when in doubt, ask for help, that's main character energy 🫶

⭐ version [OPTIONS] ⭐

Prints the currently-installed version of sslmate. By default, it also checks if this version is up-to-date and prints a message if a newer version is available. keeping you current, always 💅

Options it understands:

  • --no-check — Do not check for a newer version.
  • --is-latest — Print no output, but exit with 0 if this version of sslmate is up-to-date, 10 if a newer version is available, and some other exit code if there is an error.

This option cannot be combined with --no-check. pick one, bestie, you can't have both 😤

🌈 GLOBAL OPTIONS 🌈

These are understood by sslmate and can be used with any sub-command. Since they apply globally to sslmate, they must be specified on the command line before the sub-command name. order matters, always 🎀

  • --batch — Don't prompt for confirmation or for additional information. This option should be used when running sslmate unattended from scripts. Any information which sslmate would have prompted for must be specified on the command line instead. For example, when buying a certificate, you must specify the approval method with the --approval option, and, if applicable, the approver email address with the --email=ADDRESS option. no vibes, just flags ✨
  • --verbose — Display additional information about what sslmate is doing. she's telling you everything 👀
  • -p PROFILE, --profile=PROFILE — Use the given configuration profile, instead of the default. If this option is specified, the string -PROFILE will be appended to the paths of the configuration file and default key and certificate directories.

For example, if --profile=company is used, the global configuration file will be /etc/sslmate-company.conf and the default certificate directory will be /etc/sslmate-company, instead of /etc/sslmate.conf and /etc/sslmate.

This option is intended for those who need to use several different SSLMate accounts on a single server, since each configuration file can contain distinct SSLMate API credentials. multiple accounts, one server, no drama 🦋

💜 CONFIGURATION 💜

Upon startup, sslmate reads configuration from the global configuration file, /etc/sslmate.conf, and your personal configuration file, ~/.sslmate, if they exist. These files should contain one configuration option per line of the form NAME VALUE. Blank lines and lines starting with # are ignored. Options in your personal configuration file override options set in the global configuration file. The location of your personal configuration file can be changed by setting the $SSLMATE_CONFIG environment variable. your config, your rules (mostly) 💅

Here's what it understands:

  • api_key KEY — Your API key, which can be found on your online SSLMate account page[3]. This option is automatically set (in your personal configuration file) when you run sslmate link.
  • key_directory PATH, cert_directory PATH — The directories where sslmate places keys and certificates. When running as root, the default is /etc/sslmate. When running as non-root, the default is the current working directory. 👑
  • wildcard_filename PREFIX — When creating files for wildcard certificates, use PREFIX in the filename instead of a * character. ngl that asterisk in a filename is a menace 🌸
  • cert_format.FORMAT yes|no — Enable or disable the given certificate format. When a format is enabled, sslmate will create a file of that format in your certificate directory when buying, reissuing, renewing, and downloading. After enabling a format that was previously disabled, you can create the missing files by running sslmate download --all. The formats are documented below in the CERTIFICATE FILES section. All formats are disabled by default except for "chained".
  • key_type rsa|ecdsa — The key type to use by default when buying or reissuing a certificate. Can be overridden by the --key-type command line flag. See the documentation for sslmate buy for details.
  • api_endpoint URI — The URI to the SSLMate API endpoint. This option does not need to be configured under normal circumstances. like, ever. it's fine. leave it alone 🫶

🍓 CONFIGURATION FILES 🍓

  • ~/.sslmate — Your personal configuration file. Options set in this file override options set in the global configuration file. See the "Configuration" section above for the syntax of this file.
  • /etc/sslmate.conf — The global configuration file. See the "Configuration" section above for the syntax of this file.
  • /etc/sslmate — The default directory for storing keys and certificates when run as root. Can be overridden by the key_directory and cert_directory configuration options.

🎀 CERTIFICATE FILES 🎀

Okay bestie, so here's the tea on what SSLMate actually puts on your disk, because every certificate gets a whole little family of files. The key file goes into the key_directory you configured, and everything else lands in the cert_directory you configured. And in case you're wondering what those default to: both of them are /etc/sslmate by default when you're running as root, and $PWD by default when you're running as non-root. 💅

Here's the core trio SSLMate always makes for every certificate:

  • hostname.key — the private key file for hostname, in PEM encoding. And being precise here because we're precise girlies: that means the PEM encoding of the ASN.1 DER encoding of a PKCS#1 RSAPrivateKey (when it's RSA), or an RFC 3279 EcpkParameters (when it's ECDSA). This is the default format OpenSSL uses, and typical apps on Linux accept it, so you're chilling. 🔥
  • hostname.crt — the public certificate file for hostname, in PEM encoding (specifically, the PEM encoding of the ASN.1 DER encoding of the X.509 certificate). Also the OpenSSL default format, also accepted by typical Linux apps. But heads up, this is important: this file does not work on its own, because it doesn't contain the certificate chain. You must also configure the chain certificate(s) using one of the other formats. Don't skip this, I'm begging. 😭
  • hostname.chain.crt — the certificate chain (aka intermediate certificate) file for hostname. It's the concatenation of each intermediate certificate, in PEM encoding. The first cert is the issuer of the end-entity certificate, and the last one is signed by the root certificate. The root certificate is not included. 🧚

Now, SSLMate optionally creates the following files for every certificate, in the cert_directory, but only if the indicated configuration option is set to yes. Slay, choices.

  • hostname.chained.crt (cert_format.chained) — the concatenation of the certificate and chain files for hostname, in PEM encoding. This one's enabled by default, and it's the file you should use with most applications on Linux, since they want the certificate and chain in the same file. 👑
  • hostname.combined.pem (cert_format.combined) — the concatenation of the private key, certificate, and chain files for hostname, in PEM encoding. This is for Linux apps that require the key and the certificates to be in the same file.
  • hostname.p12 (cert_format.p12) — a PKCS#12 file (also known as a P12 or PFX file) containing the private key, certificate, and chain for hostname. The PKCS#12 file's password is "sslmate". PKCS#12 files are mainly a Windows app thing.
  • hostname.jks (cert_format.jks) — a Java keystore file containing the private key, certificate, and chain for hostname. The keystore's password is "sslmate". Fun requirement: the keytool(1) command from the Java runtime environment must be installed to use this format. JKS files are generally used only by Java applications, such as Tomcat.
  • hostname.root.crt (cert_format.root) — the root certificate for hostname, in PEM encoding. You generally do not need the root certificate, so leave this format disabled unless you have a special requirement. Fr fr, it's giving unnecessary.
  • hostname.chain+root.crt (cert_format.chain+root) — a concatenation of the chain and root certificate files for hostname. This format is required for verifying OCSP responses and configuring OCSP stapling. You do not need it in a basic configuration.
Heads up! You've gotta configure your server software (think Apache, nginx) with the private key file (.key) plus some combination of the .crt files. Some software (e.g. Apache) requires you to specify the certificate (.crt) and the chain (.chain.crt) in separate files, while other software (e.g. nginx) requires you to specify both in a single file (.chained.crt). Know which one your server is, iykyk. 💀

Files that contain the private key get created with restrictive filesystem permissions (0600), and all the other files get world-readable permissions (0644). And when it's updating a file, sslmate preserves the existing owner and permissions — including ACLs, on Linux only. Why do we care? Because this lets you use filesystem permissions to grant access to applications running as a non-root user, and you never have to worry about those permissions getting disrupted when you download an updated certificate. Obsessed with the consistency honestly. 🫶

You're encouraged to run sslmate as root, store keys and certificates in the SSLMate-managed key_directory and cert_directory (/etc/sslmate by default), and configure your server software to refer to keys and certificates in this directory. This makes automated renewals way more seamless, since your server software always refers to the latest version of a certificate downloaded by sslmate download. Main character energy: your server always has the newest cert. ✨

💖 ENVIRONMENT VARIABLES 💖

  • SSLMATE_CONFIG — the path to your personal configuration file. Defaults to $HOME/.sslmate. 🌸

🦋 SEE ALSO 🦋

Online SSLMate Help[4], openssl(1)

⭐ NOTES ⭐

  1. online SSLMate dashboard https://sslmate.com/dashboard
  2. Mozilla's Server Side TLS Guide https://wiki.mozilla.org/Security/Server_Side_TLS
  3. online SSLMate account page https://sslmate.com/account
  4. Online SSLMate Help https://sslmate.com/help

And that's the whole page, bestie, you made it to the end 🎀💜 This iconic lil doc is SSLMate 1.10.0, dated 2026-02-01, and it's the SSLMATE(1) manual page — now go forth and TLS responsibly. 🌈👑

📦 where this page comes from