This page lists the AutoInstall SSL agent commands for Linux and Windows, with the options you need for each one. You rarely need them after setup, because the agent checks and renews your certificate on its own. Use this reference when you want to install another certificate, check what the agent manages, force a check or collect logs for support.
If you have not installed the agent yet, start with our guide for Linux (Apache and NGINX) or Windows Server (IIS).
How to run the agent
The subcommands and options are the same on both systems. Only the program you call differs.
On Linux, run the agent with sudo over SSH:
sudo runautoinstallssl.sh SUBCOMMAND OPTIONSOn Windows, run it from an elevated Command Prompt or PowerShell window:
AutoInstallSSL.exe SUBCOMMAND OPTIONSOptions always start with two hyphens. A single hyphen stops the command with Single dash argument found. Run the agent with no subcommand to open its interactive menu.
Command summary
| Subcommand | What it does |
|---|---|
installcertificate | Requests, validates and installs a certificate for an order |
viewcertificates | Lists the certificates the agent manages |
reissuecertificate | Checks installed certificates and reissues any that need it |
updatednscredential | Updates a saved DNS provider credential |
diagnostic | Packs event and error logs into a zip file |
--help | Shows the agent’s built-in help |
--version | Shows the installed agent version |
installcertificate
This command installs the certificate for the order that the token belongs to. The domain comes from the order, so you do not type it. The agent generates the private key and CSR, validates the domain, installs the certificate and schedules its renewal.
The simplest way to get the right command is to copy it from your order’s installation instructions, where the token is already filled in. To open them, go to the product’s SSL Certificate tab in your SSL Dragon account and click Get started / Login.
| Option | Required | Value and purpose |
|---|---|---|
--token | Yes | The token for your order, shown on the installation instructions and the management page |
--validationtype | Yes | file or dns. Wildcard orders need dns |
--validationprovider | Yes | filesystem for file validation, or a DNS provider value from the table below |
--includewww | No | Covers both www and the bare domain |
--onlywww | No | Covers only the www version |
With neither www option, the agent requests and installs the certificate for the domain on the order only. You cannot combine the two options, and wildcard orders accept neither of them. If the web server has no site for a hostname you ask for, the agent can stop with WWW binding not found or Main domain binding not found.
File validation, covering both www and the bare domain, on Linux:
sudo runautoinstallssl.sh installcertificate --token YOUR_TOKEN --includewww --validationtype file --validationprovider filesystemThe same command on Windows:
AutoInstallSSL.exe installcertificate --token YOUR_TOKEN --includewww --validationtype file --validationprovider filesystemDNS validation through Cloudflare, for a wildcard order, on Linux:
sudo runautoinstallssl.sh installcertificate --token YOUR_TOKEN --validationtype dns --validationprovider cloudflare --cloudflareapitoken YOUR_CLOUDFLARE_API_TOKENThe agent prints the settings it found and asks you to confirm before it continues. On a wildcard order, it also asks whether to install the certificate automatically on subdomains you add to the web server later.
Running installcertificate again for an installed order forces a fresh issue and reinstall, and sets up the renewal job again. Use it when you need a new certificate before the next renewal, or when you move a site to a new server, once the agent is installed there.
DNS provider options
With --validationtype dns, set --validationprovider to one of these values and add all of that provider’s options after it. The agent does not read them if they come earlier in the command.
| Provider | Value | Options to add |
|---|---|---|
| Cloudflare | cloudflare | --cloudflareapitoken |
| GoDaddy | godaddy | --apikey, --apisecret |
| DNS Made Easy | dnsmadeeasy | --apikey, --apisecret |
| AWS Route 53 | route53 | --route53accesskeyid, --route53secretaccesskey |
| Microsoft Azure DNS | azure | --azuretenantid, --azureclientid, --azuresecret, --azuresubscriptionid, --azureresourcegroupname, --azurehostedzone |
| Google Cloud DNS | gcpdns | --serviceaccountkey (path to the key file, in double quotes), --projectid |
| DigitalOcean | digitalocean | --digitaloceanapitoken |
| Name.com | namecom | --username, --apitoken |
| Namecheap | namecheap | --apiuser, --username, --apikey, --clientip |
| OVH | ovh | --applicationkey, --applicationsecret, --consumerkey, --origin |
| RFC 2136 (such as BIND) | rfc2136 | --serverhost, --serverport, --tsigkeyname, --tsigkeysecret, --tsigkeyalgorithm |
A few values need a specific format:
- OVH:
--originis your OVH API region:Eu,Ca,Us,KimsufiEuorSoyoustartCa. - RFC 2136:
--serverhostmust be an IP address,--serverportis usually 53,--tsigkeysecretis Base64 encoded, and--tsigkeyalgorithmtakes a name such assha256, without the hmac- prefix.
The agent stores the secret values, such as API tokens and secret keys, encrypted on the server and reuses the credentials at every renewal. Treat the command as a secret too: it may stay in your shell history with the keys in plain text.
viewcertificates
This command lists the certificates the agent manages on this server. It is the quickest way to confirm that the agent installed a certificate and is tracking it.
sudo runautoinstallssl.sh viewcertificatesAutoInstallSSL.exe viewcertificatesThe name is plural. The agent’s built-in help spells it viewcertificate, but that form stops with Invalid argument passed.
reissuecertificate
This command checks every certificate the agent manages and reissues any that need it. If none do, it reports No re-issue/renewal required and changes nothing. It is the same check the agent’s scheduled job runs by itself, so you only need it when cron or the scheduled task has been disabled, or when you want to test the check by hand.
sudo runautoinstallssl.sh reissuecertificateAutoInstallSSL.exe reissuecertificateIt does not force a new certificate when none is due. To do that, run installcertificate again.
updatednscredential
This subcommand updates a saved DNS provider credential, which you need after rotating a key at your provider. If you skip it, renewals that use DNS validation will fail. It takes no options: the agent asks which credential to update, then prompts for the new values.
sudo runautoinstallssl.sh updatednscredentialAutoInstallSSL.exe updatednscredentialYou can do the same from the interactive menu: run the agent with no subcommand, choose Settings & Credentials (option 4), then Manage DNS provider credentials.
diagnostic
This command asks which dates you need, packs the agent’s event and error logs into a zip file and prints the file’s name and path. Send that file to our support team with your order number.
sudo runautoinstallssl.sh diagnosticAutoInstallSSL.exe diagnosticThe interactive menu
Run the agent with no subcommand to open its menu. Two sections go beyond the subcommands:
- Get Help (option 3) includes Get pfx password, which shows the path and password of the PFX copy for a domain.
- Settings & Credentials (option 4) includes Manage DNS provider credentials and Manage configuration.
Manage configuration holds these settings. The recommended values suit almost everyone.
| Setting | Recommended | What it controls |
|---|---|---|
| Renewal Days | 28 | How many days before expiry the agent installs a new certificate (1 to 28) |
| Reissue Days | 28 | The same window for multi-year orders |
| Auto Reissue Days | 0 | Reissues every 30, 60, 90 or 120 days even when expiry is not near; 0 turns this off |
| Auto Update | Yes | Lets the agent update itself. Turning it off can stop renewals if industry requirements change and the agent falls behind |
Command errors
These messages mean the command, or the way you ran it, is wrong. For installation and validation errors, see the troubleshooting section of the Linux or Windows guide.
| Message | Cause and fix |
|---|---|
| Invalid argument passed | The subcommand is misspelled, so check it against the summary above. If another message follows this one, that message gives the cause |
| Error: Missing option (followed by the option’s name) | Add the named option. For a DNS provider’s option, place it after --validationprovider |
| Single dash argument found | An option starts with one hyphen. Use two |
--includewww and --onlywww both can not be used at the same time | Keep only one of them |
--includewww and --onlywww can not be used with wildcard order | Remove both. A wildcard already covers www |
| Invalid combination (followed by the two values) | The two values do not match. Use file with filesystem, or dns with a DNS provider |
| No valid DNS provider found | With --validationtype dns, the provider value is not in the table above |
| Wildcard orders do not support file validation (Linux) or File validation will not work for wildcard order (Windows) | Use --validationtype dns with a DNS provider |
| Invalid validation type | Use file or dns |
| System does not have one or more required prerequisite(s) installed | On Linux, run the agent with sudo. The same message appears if neither Apache nor NGINX is installed, or if Apache has no mod_ssl |
| User does not have admin rights | On Windows, open an elevated window and run the command again |
Frequently Asked Questions
The token is on the order’s management page, in your SSL Dragon account under Manage AutoInstall SSL. The installation instructions also include it in the install command. Each order has its own token, so keep it private.
reissuecertificate checks all managed certificates and acts only on those that need it. installcertificate works on one order, identified by its token, and forces a reissue and reinstall of that certificate.
No. A cron job on Linux or a scheduled task on Windows checks the certificate automatically and renews it 28 days before expiry. Keep Auto-renewal enabled on your order so the subscription stays active.
Either the agent is not installed, or the shortcut at /usr/bin/runautoinstallssl.sh is missing. Install the agent again, or call it by its full path:sudo /opt/autoinstallssl/aisagent/runautoinstallssl.sh viewcertificates
The window was opened before the installer added the agent to the system PATH. Open a new elevated window, or run the agent from its folder. The .\ prefix is required in PowerShell and also works in Command Prompt:cd "C:\Program Files\AutoInstallSSL\aisagent"
.\AutoInstallSSL.exe viewcertificates
For the full setup, see all our AutoInstall SSL tutorials.
