AutoInstall SSL Agent Commands (Linux and Windows)

This page lists the AutoInstall SSL agent commands for Linux and Windows, with the options you need for each one. You rarely need them after setup, because the agent checks and renews your certificate on its own. Use this reference when you want to install another certificate, check what the agent manages, force a check or collect logs for support.

If you have not installed the agent yet, start with our guide for Linux (Apache and NGINX) or Windows Server (IIS).

How to run the agent

The subcommands and options are the same on both systems. Only the program you call differs.

On Linux, run the agent with sudo over SSH:

sudo runautoinstallssl.sh SUBCOMMAND OPTIONS

On Windows, run it from an elevated Command Prompt or PowerShell window:

AutoInstallSSL.exe SUBCOMMAND OPTIONS

Options always start with two hyphens. A single hyphen stops the command with Single dash argument found. Run the agent with no subcommand to open its interactive menu.

Command summary

Subcommand	What it does
installcertificate	Requests, validates and installs a certificate for an order
viewcertificates	Lists the certificates the agent manages
reissuecertificate	Checks installed certificates and reissues any that need it
updatednscredential	Updates a saved DNS provider credential
diagnostic	Packs event and error logs into a zip file
--help	Shows the agent’s built-in help
--version	Shows the installed agent version

installcertificate

This command installs the certificate for the order that the token belongs to. The domain comes from the order, so you do not type it. The agent generates the private key and CSR, validates the domain, installs the certificate and schedules its renewal.

The simplest way to get the right command is to copy it from your order’s installation instructions, where the token is already filled in. To open them, go to the product’s SSL Certificate tab in your SSL Dragon account and click Get started / Login.

Option	Required	Value and purpose
--token	Yes	The token for your order, shown on the installation instructions and the management page
--validationtype	Yes	file or dns. Wildcard orders need dns
--validationprovider	Yes	filesystem for file validation, or a DNS provider value from the table below
--includewww	No	Covers both www and the bare domain
--onlywww	No	Covers only the www version

With neither www option, the agent requests and installs the certificate for the domain on the order only. You cannot combine the two options, and wildcard orders accept neither of them. If the web server has no site for a hostname you ask for, the agent can stop with WWW binding not found or Main domain binding not found.

File validation, covering both www and the bare domain, on Linux:

sudo runautoinstallssl.sh installcertificate --token YOUR_TOKEN --includewww --validationtype file --validationprovider filesystem

The same command on Windows:

AutoInstallSSL.exe installcertificate --token YOUR_TOKEN --includewww --validationtype file --validationprovider filesystem

DNS validation through Cloudflare, for a wildcard order, on Linux:

sudo runautoinstallssl.sh installcertificate --token YOUR_TOKEN --validationtype dns --validationprovider cloudflare --cloudflareapitoken YOUR_CLOUDFLARE_API_TOKEN

The agent prints the settings it found and asks you to confirm before it continues. On a wildcard order, it also asks whether to install the certificate automatically on subdomains you add to the web server later.

Running installcertificate again for an installed order forces a fresh issue and reinstall, and sets up the renewal job again. Use it when you need a new certificate before the next renewal, or when you move a site to a new server, once the agent is installed there.

DNS provider options

With --validationtype dns, set --validationprovider to one of these values and add all of that provider’s options after it. The agent does not read them if they come earlier in the command.

Provider	Value	Options to add
Cloudflare	cloudflare	--cloudflareapitoken
GoDaddy	godaddy	--apikey, --apisecret
DNS Made Easy	dnsmadeeasy	--apikey, --apisecret
AWS Route 53	route53	--route53accesskeyid, --route53secretaccesskey
Microsoft Azure DNS	azure	--azuretenantid, --azureclientid, --azuresecret, --azuresubscriptionid, --azureresourcegroupname, --azurehostedzone
Google Cloud DNS	gcpdns	--serviceaccountkey (path to the key file, in double quotes), --projectid
DigitalOcean	digitalocean	--digitaloceanapitoken
Name.com	namecom	--username, --apitoken
Namecheap	namecheap	--apiuser, --username, --apikey, --clientip
OVH	ovh	--applicationkey, --applicationsecret, --consumerkey, --origin
RFC 2136 (such as BIND)	rfc2136	--serverhost, --serverport, --tsigkeyname, --tsigkeysecret, --tsigkeyalgorithm

A few values need a specific format:

• OVH: --origin is your OVH API region: Eu, Ca, Us, KimsufiEu or SoyoustartCa.
• RFC 2136: --serverhost must be an IP address, --serverport is usually 53, --tsigkeysecret is Base64 encoded, and --tsigkeyalgorithm takes a name such as sha256, without the hmac- prefix.

The agent stores the secret values, such as API tokens and secret keys, encrypted on the server and reuses the credentials at every renewal. Treat the command as a secret too: it may stay in your shell history with the keys in plain text.

viewcertificates

This command lists the certificates the agent manages on this server. It is the quickest way to confirm that the agent installed a certificate and is tracking it.

sudo runautoinstallssl.sh viewcertificates

AutoInstallSSL.exe viewcertificates

The name is plural. The agent’s built-in help spells it viewcertificate, but that form stops with Invalid argument passed.

reissuecertificate

This command checks every certificate the agent manages and reissues any that need it. If none do, it reports No re-issue/renewal required and changes nothing. It is the same check the agent’s scheduled job runs by itself, so you only need it when cron or the scheduled task has been disabled, or when you want to test the check by hand.

sudo runautoinstallssl.sh reissuecertificate

AutoInstallSSL.exe reissuecertificate

It does not force a new certificate when none is due. To do that, run installcertificate again.

updatednscredential

This subcommand updates a saved DNS provider credential, which you need after rotating a key at your provider. If you skip it, renewals that use DNS validation will fail. It takes no options: the agent asks which credential to update, then prompts for the new values.

sudo runautoinstallssl.sh updatednscredential

AutoInstallSSL.exe updatednscredential

You can do the same from the interactive menu: run the agent with no subcommand, choose Settings & Credentials (option 4), then Manage DNS provider credentials.

diagnostic

This command asks which dates you need, packs the agent’s event and error logs into a zip file and prints the file’s name and path. Send that file to our support team with your order number.

sudo runautoinstallssl.sh diagnostic

AutoInstallSSL.exe diagnostic

The interactive menu

Run the agent with no subcommand to open its menu. Two sections go beyond the subcommands:

• Get Help (option 3) includes Get pfx password, which shows the path and password of the PFX copy for a domain.
• Settings & Credentials (option 4) includes Manage DNS provider credentials and Manage configuration.

Manage configuration holds these settings. The recommended values suit almost everyone.

Setting	Recommended	What it controls
Renewal Days	28	How many days before expiry the agent installs a new certificate (1 to 28)
Reissue Days	28	The same window for multi-year orders
Auto Reissue Days	0	Reissues every 30, 60, 90 or 120 days even when expiry is not near; 0 turns this off
Auto Update	Yes	Lets the agent update itself. Turning it off can stop renewals if industry requirements change and the agent falls behind

Command errors

These messages mean the command, or the way you ran it, is wrong. For installation and validation errors, see the troubleshooting section of the Linux or Windows guide.

Message	Cause and fix
Invalid argument passed	The subcommand is misspelled, so check it against the summary above. If another message follows this one, that message gives the cause
Error: Missing option (followed by the option’s name)	Add the named option. For a DNS provider’s option, place it after --validationprovider
Single dash argument found	An option starts with one hyphen. Use two
--includewww and --onlywww both can not be used at the same time	Keep only one of them
--includewww and --onlywww can not be used with wildcard order	Remove both. A wildcard already covers www
Invalid combination (followed by the two values)	The two values do not match. Use file with filesystem, or dns with a DNS provider
No valid DNS provider found	With --validationtype dns, the provider value is not in the table above
Wildcard orders do not support file validation (Linux) or File validation will not work for wildcard order (Windows)	Use --validationtype dns with a DNS provider
Invalid validation type	Use file or dns
System does not have one or more required prerequisite(s) installed	On Linux, run the agent with sudo. The same message appears if neither Apache nor NGINX is installed, or if Apache has no mod_ssl
User does not have admin rights	On Windows, open an elevated window and run the command again

Frequently Asked Questions

For the full setup, see all our AutoInstall SSL tutorials.