How to Automatically Sync SSL Certificates from 1Panel to SafeLine WAF

Description and use

Automate SSL certificate sync between 1Panel and SafeLine WAF using a Python script that compares serial numbers and updates via OpenAPI, removing manual uploads.

Problem

Certificates renewed automatically in 1Panel are not automatically deployed to SafeLine WAF, requiring manual upload and creating operational risk.

Outcome

Automated synchronization eliminates manual uploads, reduces operational risk, and ensures SafeLine serves the latest certificates after 1Panel renewal.

Workflow

• 1. 1Panel renews the SSL certificate and stores the new fullchain.pem and privkey.pem locally.
• 2. The Python script reads the local certificate files using the cryptography library to extract the serial number.
• 3. The script calls SafeLine’s GET /api/open/cert/{id} endpoint to retrieve the current certificate’s serial number.
• 4. If the serial numbers differ, the script sends a POST /api/open/cert request with the existing certificate ID, the new certificate content, and the private key to update the certificate.
• 5. The script can perform a dry‑run to verify changes before applying them.
• 6. The script is scheduled via 1Panel’s scheduled task system to run after certificate renewal (e.g., weekly).

Evidence

Certificates renew automatically in 1Panel, but the WAF may still be serving an older certificate.

Source

A Python script reads the certificate files.

Source

The script retrieves the currently configured certificate from SafeLine's API.

Source

If they differ, the script updates the certificate through OpenAPI.

Source

The guide includes troubleshooting API requests blocked by SafeLine.

Source