🔐 Auto SSL

Certificates that renew themselves

One installer sets up Let's Encrypt on a Debian or Ubuntu server, keeps every certificate renewed, and tells you on Telegram when something needs attention.

bash <(curl -fsSL https://github.com/Plus98ir/Auto_SSL/releases/latest/download/install-ssl-manager.sh)

Run it as root. It asks a few questions, then opens the ssl menu.

What it does

New certificates: Standard (with www added only when it resolves) or wildcard. Picks nginx or standalone mode on its own.
Checks before issuing: Confirms the domain points to this server and that port 80 is free, so failed attempts don't burn your Let's Encrypt quota.
Automatic renewal: Uses certbot's own timer, or cron when a proxy is set. Nothing gets scheduled twice.
After every renewal: Reloads nginx, optionally copies the files to a folder of your choice, runs your own command, and notifies Telegram.
Expiry report: A daily check that messages you when any certificate has 20 days or fewer left.
Wildcard that renews: Cloudflare API mode renews wildcards unattended. Manual TXT mode is still there, with a warning.
Telegram bot: Status, renew, new certificate, download and backup from your phone. Supports several admins.
Export: Writes .crt, .key and optionally .pfx for panels like x-ui and Marzban.
Backup and restore: Archives all of /etc/letsencrypt in one file, and puts it back just as easily.
Dry run: Test issuing or renewing against the staging server without using real quota.
Clean uninstall: Removes the bot, schedules and scripts. Your certificates stay where they are.

Step 1: create the bot (optional)

Skip this if you only want the terminal menu.

Open Telegram and message @BotFather.
Send /newbot and choose a display name.
Choose a username that ends in bot, for example MySSLManagerBot.
Copy the HTTP API token.
Get your numeric ID by sending /start to @userinfobot. Repeat for every admin.

Keep the token private. If it leaks, revoke it in BotFather with /revoke and run the installer again.

Step 2: install

On a Debian or Ubuntu server, as root:

bash <(curl -fsSL https://github.com/Plus98ir/Auto_SSL/releases/latest/download/install-ssl-manager.sh)

The installer asks for:

An HTTP proxy, only if the server can't reach Let's Encrypt and Telegram directly.
The bot token and admin IDs, separated by commas. Press Enter to skip the bot.
Whether the bot may send private keys. The default is no.
An email address for Let's Encrypt notices.

It then installs the packages, writes the config, the renewal hook, the daily expiry check and the bot service, and opens the menu.

Upgrading from v1? Run systemctl disable --now ssl-bot first, so two listeners never poll the same token.

Terminal menu

Type ssl at any time.

Option	What it does
1 New certificate	Standard or wildcard, with an optional dry run first.
2 Renew one	Pick a domain from the list and force-renew it.
3 Renew all	Renews everything that is due, or tests it with a dry run.
4 Status of all	Full certbot output plus days left for each domain.
5 Status of one	Details for a single certificate.
6 Delete or revoke	Deletes locally, or revokes at Let's Encrypt too. Removes the matching nginx vhost.
7 Export	Writes `.crt` / `.key` / `.pfx` to `/root/ssl-exports/`.
8 Backup or restore	Archives to `/root/ssl-backups/`, or restores from an archive.
9 Settings	Post-renew command, copy-to folder, and a Telegram test message.
10 Uninstall	Removes SSL Manager. Certificates are kept.

Telegram bot

Only the admin IDs you entered get a reply. Everyone else is ignored.

Command	What it does
`/start`	Opens the button menu.
`/status`	Pick a domain to see its details and days left.
`/renew`	Pick a domain to renew now.
`/newcert example.com`	Checks DNS and port 80, issues the certificate and sends the files.
`/download`	Pick a domain to receive its certificate files.
`/backup`	Creates a backup on the server, and sends it if key sending is on.

With SEND_KEYS="no" the bot sends only fullchain.pem and tells you where the private key is on the server. Anything sent through Telegram stays on Telegram's servers.

How renewal works

You don't need to do anything once a certificate is issued.

Without a proxy, certbot's own certbot.timer handles renewals.
With a proxy, the timer is turned off and a cron job runs certbot renew twice a day with the proxy set.
After every successful renewal, the hook in /etc/letsencrypt/renewal-hooks/deploy/ reloads nginx, copies the files if you set a folder, runs your command, and messages the admins.
Every morning at 09:30 server time, the expiry check reports anything close to expiring.
Manual-mode wildcards can't renew on their own. Use Cloudflare mode, or repeat the manual step every 90 days.

Configuration

Everything lives in /etc/ssl-manager/config (mode 600). Menu option 9 edits the common settings for you.

Setting	Default	Meaning
`EMAIL`	—	Address for Let's Encrypt notices.
`PROXY_URL`	empty	For example `http://user:[email protected]:8080`. Leave empty for a direct connection.
`BOT_TOKEN`	—	Token from BotFather.
`ADMIN_IDS`	—	Numeric IDs, comma separated.
`SEND_KEYS`	`no`	Whether the bot may send private keys and backups.
`POST_RENEW_CMD`	empty	Run after each renewal, for example `systemctl restart xray`.
`COPY_TO_DIR`	empty	Copy `fullchain.pem` and `privkey.pem` here after each renewal.
`EXPIRY_WARN_DAYS`	`20`	Report certificates with this many days or fewer left.

Files

Path	Purpose
`/etc/ssl-manager/config`	Settings and secrets.
`/usr/local/bin/ssl`	Terminal menu.
`/usr/local/bin/ssl-bot.sh`	Telegram bot, run by the `ssl-bot` service.
`/usr/local/bin/ssl-lib.sh`	Shared helpers.
`/usr/local/bin/ssl-expiry-check.sh`	Daily expiry report.
`/etc/letsencrypt/renewal-hooks/deploy/00-ssl-manager.sh`	Runs after every renewal.
`/var/log/ssl-manager.log`	Issues, renewals and warnings.
`/root/ssl-backups/`	Backup archives.
`/root/ssl-exports/`	Exported certificate files.

Security

The config file and the Cloudflare token are readable by root only (600).
The bot token is read from the config, never written into scripts. Bot scripts are 700.
The proxy password is typed hidden and URL-encoded, so characters like @ or # work.
Admin checks use the sender's ID, not the chat ID.
Private keys are never sent over Telegram unless you turn it on.
After a restart the bot skips old messages, so a command sent earlier never runs twice.

Do you need a proxy?

Only if the server can't reach acme-v02.api.letsencrypt.org or api.telegram.org directly. Servers outside Iran should leave it empty.

The proxy has to be reachable from the server itself. 127.0.0.1 means the server, not your own computer. Check it with:

ss -ltnp | grep <port>
curl -x http://127.0.0.1:<port> -I https://api.telegram.org

Troubleshooting

Symptom	Cause and fix
The bot doesn't answer	Check `systemctl status ssl-bot` and `journalctl -u ssl-bot -f`. Make sure an old v1 listener isn't using the same token, and that your ID is in `ADMIN_IDS`.
Domain does not resolve	The A record is missing or hasn't propagated. Fix DNS and try again.
Port 80 is busy	Another service (Apache, HAProxy, Xray) holds port 80. Stop it for issuing, or put nginx in front.
Too many failed authorizations	Let's Encrypt rate limit. Wait an hour and use a dry run until it passes.
Wildcard didn't renew	It was issued in manual mode. Reissue it in Cloudflare mode.
Renewed, but the site shows the old certificate	The service using it wasn't restarted. Set `POST_RENEW_CMD`.
No renewal messages on Telegram	Use menu option 9 to send a test message. If it fails, check the token and the proxy.