Automated certificate management

Automated certificate management is a service that helps users request, deploy, and renew SSL/TLS certificates more efficiently. It supports automation through ACME-compatible clients such as Certbot, reducing manual effort and lowering the risk of service disruptions caused by expired certificates.

Details

This service provides the following benefits:

  • Automates domain validation through the ACME protocol, reducing the need for repeated manual verification steps

  • Automatically requests, obtains, and renews SSL/TLS certificates throughout the certificate lifecycle

  • Reduces manual administrative effort and lowers the risk of human error

  • Supports more reliable HTTPS service continuity by helping ensure certificates are renewed on time

 

Why choose automated certificate management over manual certificate management?

✅ Less need to track renewals manually

✅ Lower risk of certificate expiry

✅ A more consistent and streamlined process

✅ Better suited to large-scale or long-running services

Available To
Staff
Service Fee

Free

Service Hours

7×24

Getting Started

To request Automated certificate management, please follow the steps below:

  1. Complete the online request form.

  2. Wait for the confirmation email indicating that the ACME registration has been completed.

  3. Install an ACME client (e.g., Certbot or win‑acme).

  4. Use an ACME client to issue and deploy your certificate by setting “https://acme.ust.hk/acme/directory” as the server URL.

Related Tools

The following instructions provide a general example of how SSL certificate management can be automated using Certbot. The example below uses an Apache environment for illustration. Depending on your server configuration, operating system, web server, and deployment architecture, you should review your own environment and adapt the implementation accordingly.

1.

Install Certbot

Install Certbot using the appropriate package manager for your system.

Example (Ubuntu 24, without plugin):

# apt install -y certbot

2.

Configure Certbot (cli.ini)

Update the configuration file: /etc/letsencrypt/cli.ini

Example configuration:

server = https://acme.ust.hk/acme/directory

no-eff-email

register-unsafely-without-email

agree-tos

3.

Certificate Issuance Example (Apache)

This Apache example is for reference only. If your environment uses a different web server, operating system, plugin, or deployment method, please adjust the commands and renewal steps accordingly.

Example command using webroot method:

# certbot certonly --webroot -w /var/www/html -d <Servcie Domain>.hkust.edu.hk --deploy-hook "systemctl reload apache2"

Notes:

  • Apache listening on port 80
  • Webroot path must match your document root
  • --deploy-hook reloads Apache after successful renewal

4.

Test Renewal (Dry Run)

Validate auto-renewal process before production use:

# certbot renew -v --dry-run
Learn More

Support

General Enquiries cchelp@ust.hk
Suggestions & Complaints cclisten@ust.hk
Serviceline +852-2358-6200