Cart
Latest Announcements (6)
2026 (7th) China Internet Basic Resources Conference | 西部数码 became one of the first member units of the Domain Name Industry Information Sharing Work Promotion GroupAnnouncement by 西部数码 on the Reservation Deadline Adjustment and Price Increase for .COM/.NET Domain Names"刺猬响站" has officially launched, making corporate website building easier.西部数码 officially launches premium domain name reservation service, helping enterprises secure high-quality digital assets.西部数码 AI security scan/repair feature launched西部数码 DNS resolution statistics function officially launched.View All Announcements
Sign Up Bonus

The process of using the westssl tool to automatically update SSL certificates.

Published: 2023-11-02

SSL certificates have two default validity periods: 3 months and 1 year. You must renew and update the certificate within 30 natural days before it expires in order to extend the service period of the certificate. When renewing a certificate,
a new certificate will be issued. After you receive the new certificate, you need to manually update it on the server. Some certificates support purchasing multiple years at once, but a one-year certificate is still issued each time, and it will be automatically reissued about 30 days before expiration.

If you manage many certificates, frequently updating them manually is not only troublesome but also prone to omissions or errors. Therefore, West Digital provides this tool to implement an automatic update process after certificate renewal and reissuance.


To achieve automatic certificate renewal, the following conditions must be met:

  1. Automated DNS validation (The SSL certificate and domain name must be under the same West Digital member account. If the domain is with Tencent or Alibaba, you can set an apikey in our control panel to complete validation,
    If the domain is on a third-party platform, it is recommended to transfer it to us for unified management; otherwise, you need to validate again when the certificate is reissued)

  2. After the certificate is reissued, it can be automatically updated. (If the certificate is used for West Digital virtual hosting/anti-DDoS servers/Yashu Cloud servers, after certificate renewal and reissuance,
    the system will automatically update the certificate without any operation. When the certificate is used for West Digital ordinary cloud servers or third-party server scenarios, automatic SSL certificate updates can be achieved through this tool and scheduled tasks,
    To use this tool, your certificate must be    applied foror hosted with us.    )

  3. For scenarios that meet the above conditions, select the "Auto Renewal" feature when purchasing, and you can do it once and for all. You need to ensure that the member account balance is sufficient.


The Westssl tool has two versions: Windows and Linux. This toolis used for West Digital ordinary cloud servers or third-party server scenarios. It can automatically update certificates after certificate reissuance, and also supports calling the API
in batch to purchase new certificates (see the help at the end of this article).

Environment requirements: An SSL certificate must already be deployed on the server, and the web service must be one of IIS/Apache/Nginx. 
(The initial deployment of a certificate is outside the scope of this article. Generally, Windows hosts can be deployed using the website Management Assistant provided by us, and Linux hosts are generally deployed through the BaoTa Panel)

To use the westssl tool, you need to set a dedicated API key for SSL certificates. You can set or reset it in "Member Center --- Account Management --- Settings Center --- SSL Certificate API Key Settings".

(Submit a ticket and we will set up Westssl automatic update for you;this API key must be provided in the ticket)

image.png


Linux (CentOS) system download method SSH to the remote server, then execute  

wget http://downinfo.myhostadmin.net/westssl/westssl.zip -O /root/westssl.zip && unzip -o /root/westssl.zip && rm -f /root/westssl.zip && chmod +x /root/westssl   

Enter /root/westssl to use it

Windows server system download method , connect to the remote server and use a browser to download  http://downinfo.myhostadmin.net/westssl/westssl.exe  (If the download prompts that it cannot be downloaded securely, please right-click and select "Save link as".) , it is recommended to save it in the d:\cert directory.

Switch the cmd command line to d:\cert   . Enter westssl.exe to use it    


westssl version number: westssl version 1.0.50


1. After downloading, first perform initialization (Important)  After initialization, .westssl\config.ini will be generated automatically; do not delete it

/root/westssl init  

 image.png

For the command to restart or reload the web service, you can select the corresponding number, or enter it manually. Please be sure to enter it according to your actual environment!

2. View the current server certificate list   /root/westssl show   

image.png

For web environments created by BaoTa and the West Digital Website Building Assistant, the system will recognize the relevant certificates, so you do not need to add them manually and can ignore this step.


For web environments not created by BaoTa or the West Digital Website Building Assistant, you need to manually add the SSL certificate path to automatically update SSL certificates. Under the show command, enter  1 to add a domain certificate.

image.png


3. You can use scheduled tasks to complete automatic certificate updates: the certificate update command  /root/westssl update  

Linux scheduled task configuration method (Make sure the server time is the correct Beijing time, otherwise the update will time out and fail!)

1. For the BaoTa environment, add a daily scheduled update through the panel's scheduled tasks.

Script content:

cd /root 

/root/westssl update


image.png

After saving the scheduled task, the SSL certificate will be automatically updated every day.


2. In non-BaoTa Linux environments,use the command "crontab -e" to add a scheduled task 

30 1 * * * /root/westssl update

The above command means the automatic SSL certificate update is executed every day at 1:30.

It is recommended to add a scheduled task to automatically update the server time.



Windows scheduled task configuration method

In Task Scheduler, add a routine task to run this tool.

Run cmd as administrator and execute:

image.png

 

schtasks /create /RU system /SC DAILY /F /TN westssl_auto_update /TR  "D:\cert\westssl.exe update -c D:\cert\.westssl\config.ini"  /ST 01:00
Where:
westssl_auto_update is the scheduled task name
"D:\cert\westssl.exe update -c D:\cert\.westssl\config.ini" is the program and parameters to execute
/ST 01:00 means execute every day at 1:00

After successfully creating the scheduled task, the SSL certificate will be automatically updated every day at 1:00.


Note:

api result: token timeout: please check whether the server time is Beijing time.


1. On Windows, westssl update will generate the executable file westcertapp.exe in the .westssl subdirectory. This is a normal update file and is safe to use.

      If this file fails to execute, the corresponding IIS site certificate will fail to update, which may affect normal website access.

2. The westssl update command automatically checks the expiration time of all certificates on the current server. If the certificate is less than 30 days from expiration, or has been expired for no more than 30 days,

     it will automatically call the West Digital SSL certificate API to check whether a new certificate has been issued for the relevant domain. If so, it will automatically download the new certificate for replacement,

     After replacement, it will execute relevant commands to restart IIS/Apache/Nginx to make the new certificate take effect.

3. When manually importing an SSL certificate through IIS, the certificate store must be set to  Personal, otherwise westssl cannot recognize it.

V0%U$O29`N15MFDS`SCR`L6.jpg


-----------------------------------------------------------------------------------------------------------------

Process for batch purchasing certificates with westssl: (Note: You can enter westssl.exe -h to display help, and the issue command means applying for a new certificate)


Note: If you need to give your apikey to users to allow them to update SSL certificates themselves, but do not want them to have permission to purchase new certificates, please submit a ticket. You can apply to have the permission to purchase certificates through the API specifically disabled for your username.


D:\cert>westssl.exe issue    

Missing required parameters!

Apply for certificate

Usage:

  westssl issue [flags]


Flags:

  -c, --config string   Config file (default "config.ini")

      --dns             SSL certificate DNS validation method [file,dns validation must choose one]

  -d, --domain string   [Required] domain name for the SSL certificate; this parameter supports 3 modes:

                        1) Single domain name.

                        2) Multiple domain names, must be separated by commas (,).

                        3) Batch domain purchase, which must be the full path to a domain list file. Put each domain to purchase on a separate line in this file.

      --file            SSL certificate file validation method [file,dns validation must choose one]

  -h, --help            help for issue

  -t, --type string     [Required] common certificate types:

                        1) Universal DV: dv-350

                        2) 90-day trial DV: free-trial


                        For more product models, please visit the API interface to query: https://console-docs.apipost.cn/preview/4e5d940c9be19cda/73e3028374812fc5?target_id=9d27cd1e-6bfa-4665-9a8f-e421b7707a1c



D:\cert>westssl.exe issue   --dns  -t free-trial -d mytest123.com

or:

D:\cert>westssl.exe issue   --dns  -t free-trial -d D:\cert\mydomains.txt   Put all the domains to purchase in this txt file for batch purchasing.


-----------------------------------------------------------------------------------------------------------------

Use westssl to batch download purchased certificates

D:\cert>westssl.exe online

Online SSL certificate download


Usage:

  westssl online [flags]


Flags:

  -c, --config string   Config file (default "config.ini")

      --domain string   Download the certificate for the domain name:

                        1. Multiple domain names must be separated by commas (,).

                        2. all means download all certificates.

                        3. Full path to the certificate batch download list file. Put the certificate domains to download on separate lines in this file.

  -h, --help            help for online

      --show            View the online certificate list


D:\cert>westssl.exe online --domain mytest123.com

or:

D:\cert>westssl.exe online --domain D:\cert\mydomains.txt   Put all certificate domains to download in this txt file for batch downloading.



D:\cert>westssl.exe online --show  can be used to view the online certificate list and check validation parameter values


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~