Daily ops日常操作

generate, deploy, renew, monitor, and the full command list.申请、部署、续期、监控，以及命令速查。

cert-manager.sh · generate · deploy · renew · monitor

All commands run inside the manager container. Replace domains and server IDs with yours.以下命令都在管理容器里执行。域名和服务器 ID 换成你自己的。

Issue certificates申请证书

generate

# one domain (as configured)
$ docker exec acme-ssl-manager /scripts/cert-manager.sh generate example.com

# all domains in domains.yml
$ docker exec acme-ssl-manager /scripts/cert-manager.sh generate-all

# force / dry-run
$ docker exec acme-ssl-manager /scripts/cert-manager.sh generate example.com -f
$ docker exec acme-ssl-manager /scripts/cert-manager.sh generate-all -d

Certs land under /data/certs/ (host: ./data/certs/). ECC dirs often end with _ecc.证书落在容器 /data/certs/（宿主机 ./data/certs/）。ECC 目录名常带 _ecc 后缀。

Deploy部署

deploy

$ docker exec acme-ssl-manager /scripts/cert-manager.sh \
  deploy example.com server_prod_01

# optional custom remote directory name
$ docker exec acme-ssl-manager /scripts/cert-manager.sh \
  deploy example.com server_prod_01 custom-dir

$ docker exec acme-ssl-manager /scripts/cert-manager.sh deploy-all

deploy-all skips deploy_method: manual.deploy-all 会跳过 deploy_method: manual 的域名。
Prefers fullchain.cer, backs up old files, then runs nginx_reload_cmd.优先用 fullchain.cer，先备份旧文件，再执行 nginx_reload_cmd。

Renew续期

renew

$ docker exec acme-ssl-manager /scripts/cert-manager.sh renew example.com
$ docker exec acme-ssl-manager /scripts/cert-manager.sh renew-all

Cron renews certificates inside the 30-day window daily around 03:00 (container TZ Asia/Shanghai).定时任务大约每天 03:00（容器时区 Asia/Shanghai）续期 30 天内到期的证书。

Status, monitor, report状态、监控、日报

status

$ docker exec acme-ssl-manager /scripts/cert-manager.sh status example.com
$ docker exec acme-ssl-manager /scripts/cert-manager.sh status-all
$ docker exec acme-ssl-manager /scripts/cert-manager.sh list
$ docker exec acme-ssl-manager /scripts/cert-manager.sh monitor
$ docker exec acme-ssl-manager /scripts/cert-manager.sh report
$ docker exec acme-ssl-manager /scripts/cert-manager.sh test example.com

Command cheat sheet命令速查

Command命令	What it does作用
`generate / generate-all`	Issue certs via ACME DNS-01经 ACME DNS-01 申请
`deploy / deploy-all`	SSH deploy; skip manualSSH 部署；跳过 manual
`renew / renew-all`	Renew; renew-all also packs manual ZIPs续期；renew-all 后会打 manual ZIP
`pack-manual`	Pack ZIP/tar for manual targets为 manual 目标打 ZIP/tar
`verify-chains`	Check full chain files检查完整证书链文件
`list-manual`	Manual / CDN inventory列出需手动处理的域名
`revoke`	Revoke a domain cert吊销域名证书
`cleanup`	Prune old logs/backups清理旧日志和备份
`-h / -v / -f / -d`	help / verbose / force / dry-run帮助 / 详细 / 强制 / 预演

monthly pass每月巡检 Printable four-step loop (status → renew → deploy auto+manual → verify): Monthly renew checklist. Dual-track deploy: Deploy. 可打勾四步（状态 → 续期 → 自动+手动部署 → 验收）：每月换证 checklist。双轨部署见证书部署。