Automatic SSL Certificate Renewal
Summary
As of version 6.5, VALT can automatically apply renewed SSL certificates for you.
When enabled from the VALTMenu, the SSL Renewal Watcher watches the /usr/local/valt/ssl/incoming/ directory. When a complete certificate set appears within a 10-minute window, VALT installs it over the existing set and restarts the Web, Wowza, and Nginx containers so they use the new files (deferred, and noted in the log, if there are active recordings). A complete set is either:
fullchain.pem+privkey.pem(also use this form for a leaf-only certificate)cert.pem+chain.pem+privkey.pem
How It Functions
Order of Operations
- In the VALTMenu, go to 3 SSL Settings, then select 4 Enable SSL Renewal Watcher.
- Set the schedule in
/usr/local/valt/conf/ssl_renewer_config(see Execution Frequency Options below). - Copy a complete certificate set (either format above) into the /incoming directory.
Based on the frequency: instant applies the set immediately, while scheduled, weekly, and monthly apply it at the configured time — copy in a fresh set before each scheduled run. Editing the config later automatically updates the schedule. All activity is logged to /usr/local/valt/logs/SSLRenewalWatcher.log.
Execution Frequency Options
| Execution Frequency | What happens? |
|---|---|
instant |
Applies the certificates immediately. |
scheduled |
Runs once at the specified date and time, then removes itself. |
weekly |
Runs every week on the specified day and time. |
monthly |
Runs every month on the specified day and time. |
Error Checking
All activity is logged to /usr/local/valt/logs/SSLRenewalWatcher.log. Before installing, the watcher confirms:
- A complete set was updated within the 10-minute window.
- Each certificate is a valid x509 certificate and the private key is valid (RSA or EC).
- The leaf certificate and private key match, the certificate is not expired, and the chain is valid.
- The incoming certificates differ from the ones already installed (otherwise it skips; override with
SSLRenewer.bash --force).
Any files that are not part of a valid set are logged and ignored.
⇧ Back to Top