Ssl
fm ssl¶
Ssl commands.
Usage:
Options:
--help: Show this message and exit.
Commands:
renew: Renew SSL certificates.list: List SSL certificates.add: Add an SSL certificate for a domain.remove: Remove an SSL certificate for a domain.acme-sh: Run acme.sh commands directly with FM's environment (advanced users).
fm ssl renew¶
Renew SSL certificates.
Supports bench and standalone modes. Use --dry-run to validate against Let's Encrypt staging; --force forces renewal.
Usage:
Arguments:
BENCHNAME: Name of the bench (omit for standalone mode).DOMAIN: Specific domain to renew. If omitted, renews all certificates for the bench/standalone.
Options:
--all: Renew ssl cert for all benches.--standalone: Renew certificates for external domains--dry-run: Test renewal using Let's Encrypt staging server without modifying the system.-f, --force: Force renewal even if certificate is not due for renewal.
Examples¶
Renew all certificates for a bench¶
Renews all TLS certificates associated with the specified bench.
Renew certificate for specific domain¶
Renews a single domain certificate for the given bench.
Renew all certificates for all benches¶
Renews certificates across all benches managed by FM when run by an administrator.
Test renewal with Let's Encrypt staging (dry-run)¶
Simulates the renewal using Let's Encrypt staging environment to validate configuration.
Renew specific external (standalone) domain¶
Renews a standalone external domain certificate managed outside benches.
Renew all external (standalone) domains¶
Renews all external standalone certificates managed by FM.
fm ssl list¶
List SSL certificates.
Use without flags to list certificates for a bench, or pass --standalone or --all to change scope.
Usage:
Arguments:
BENCHNAME: Name of the bench (omit for standalone mode).
Options:
--standalone: List certificates for external (non-bench) domains--all: List all certificates (bench + external)
Examples¶
List SSL certificates for a bench¶
Shows certificates installed for a specific bench.
List all external (standalone) certificates¶
Lists certificates managed in standalone (external project) mode.
List all certificates (bench + external)¶
Lists both bench-installed and external certificates together.
fm ssl add¶
Add an SSL certificate for a domain.
Supports bench mode (adds certificate to a bench) and standalone mode for external Docker projects using FM nginx-proxy. Use --dry-run to validate issuance against Let's Encrypt staging first.
Usage:
Arguments:
BENCHNAME: Name of the bench (omit for standalone mode).DOMAIN: Domain name for the certificate
Options:
-c, --challenge: Challenge type--cname: CNAME delegation record for DNS-01 challenge (requires dns01)--dry-run: Test certificate generation using Let's Encrypt staging server without adding it to the system.--standalone: Manage SSL for external (non-bench) Docker project. Use with docker network 'fm-global-frontend-network'.--skip-dns-check: Skip DNS validation before certificate generation (use if DNS will be configured later).--wait-for-dns: Wait for DNS propagation (polls every 30s for up to 5 minutes).
Examples¶
Add SSL certificate with HTTP-01 challenge¶
Requests a certificate using an HTTP-01 challenge and installs it into the bench's nginx configuration.
Add SSL certificate with DNS-01 challenge (Cloudflare)¶
Requests a certificate using DNS-01 validation; configure DNS provider credentials first when required.
Add for external Docker project (standalone mode)¶
Manage SSL for an external Docker project by using standalone mode and FM's nginx-proxy.
Test with Let's Encrypt staging (dry-run)¶
Performs a dry-run against Let's Encrypt staging environment to validate configuration without issuing production certs.
Add with CNAME delegation for DNS validation¶
Uses a CNAME delegation target for DNS-01 validation when the DNS zone is delegated to another provider.
fm ssl remove¶
Remove an SSL certificate for a domain.
Works in bench mode (removes from a bench) or standalone mode for external Docker projects.
Usage:
Arguments:
BENCHNAME: Name of the bench (omit for standalone mode).DOMAIN: Domain name of the certificate to remove
Options:
-y, --yes: Skip confirmation prompt--standalone: Remove certificate for external (non-bench) domain
Examples¶
Remove SSL certificate from a bench¶
Removes the certificate from the bench and its nginx configuration. Use --yes to skip confirmation.
Remove without confirmation¶
Removes the certificate immediately without prompting for confirmation.
Remove external (standalone) certificate¶
Removes a certificate managed in standalone mode for external Docker projects.
fm ssl acme-sh¶
Run acme.sh commands directly with FM's environment (advanced users).
Advanced users only: this bypasses FM's certificate management. Prefer 'fm ssl add/remove/renew' for normal workflows.
Usage:
Examples¶
Show acme.sh help and available commands¶
Displays acme.sh help. Use for learning available subcommands and flags.
List all certificates managed by acme.sh¶
Lists certificates that acme.sh currently manages in its home directory.
Show certificate information for a domain¶
Shows detailed information for a managed certificate for the domain.
Check acme.sh version¶
Prints the installed acme.sh version used by FM.
Upgrade acme.sh to latest version¶
Upgrades the bundled acme.sh installation to the latest release.
Force renew certificate for a domain¶
Forces a renewal for a certificate using acme.sh; advanced option for recovery and testing.
fm ssl dns-config¶
Dns-Config commands.
Usage:
Options:
--help: Show this message and exit.
Commands:
cloudflare: Configure Cloudflare DNS credentials for DNS-01 challenge.
fm ssl dns-config cloudflare¶
Configure Cloudflare DNS credentials for DNS-01 challenge.
Credentials can be configured at two levels: - [bold]Global[/bold]: Used by all benches (omit benchname) - [bold]Bench-specific[/bold]: Override for a specific bench (provide benchname)
[bold cyan]Authentication Methods:[/bold cyan]
- [green]API Token[/green] (Recommended):
- More secure with scoped permissions
- Create at: https://dash.cloudflare.com/profile/api-tokens
- Template: "Edit zone DNS"
-
Required permission: Zone > DNS > Edit
-
[yellow]Global API Key[/yellow] (Legacy):
- Full account access (less secure)
- Requires --email with your Cloudflare account email
- Find at: https://dash.cloudflare.com/profile/api-tokens
Usage:
Arguments:
BENCHNAME: Bench name for bench-specific credentials. Omit for global configuration.
Options:
--api-token: Cloudflare API Token (recommended - scoped permissions)--api-key: Cloudflare Global API Key (legacy - full account access)--email: Cloudflare account email (required with Global API Key)-s, --show: Show current Cloudflare DNS credentials-r, --remove: Remove Cloudflare DNS credentials
Examples¶
Configure global Cloudflare credentials using API Token (recommended)¶
Stores a global Cloudflare API token for DNS-01 challenges. Recommended for scoped permissions.
Configure global Cloudflare credentials using API Key (legacy)¶
Stores legacy Global API Key credentials; less secure and requires account email.
fm ssl dns-config cloudflare --api-key YOUR_API_KEY --email [email protected]
Configure bench-specific Cloudflare credentials (overrides global)¶
Sets Cloudflare credentials for a specific bench, overriding global configuration.
Show global Cloudflare DNS credentials configuration¶
Displays stored global Cloudflare credentials (if any).
Show bench-specific Cloudflare DNS credentials¶
Displays stored Cloudflare credentials for the specified bench.
Remove global Cloudflare DNS credentials¶
Removes global Cloudflare credential configuration.
Remove bench-specific Cloudflare DNS credentials¶
Removes Cloudflare credential configuration for the specified bench.