How to Automatically Sync SSL Certificates from 1Panel to SafeLine WAF

说明与用途

使用 Python 脚本通过比较序列号并通过 OpenAPI 更新，自动同步 1Panel 与 SafeLine WAF 之间的 SSL 证书，消除手动上传的需要。

问题

Certificates renewed automatically in 1Panel are not automatically deployed to SafeLine WAF, requiring manual upload and creating operational risk.

结果

Automated synchronization eliminates manual uploads, reduces operational risk, and ensures SafeLine serves the latest certificates after 1Panel renewal.

工作流

• 1. 1Panel renews the SSL certificate and stores the new fullchain.pem and privkey.pem locally.
• 2. The Python script reads the local certificate files using the cryptography library to extract the serial number.
• 3. The script calls SafeLine’s GET /api/open/cert/{id} endpoint to retrieve the current certificate’s serial number.
• 4. If the serial numbers differ, the script sends a POST /api/open/cert request with the existing certificate ID, the new certificate content, and the private key to update the certificate.
• 5. The script can perform a dry‑run to verify changes before applying them.
• 6. The script is scheduled via 1Panel’s scheduled task system to run after certificate renewal (e.g., weekly).

证据

Certificates renew automatically in 1Panel, but the WAF may still be serving an older certificate.

来源

A Python script reads the certificate files.

来源

The script retrieves the currently configured certificate from SafeLine's API.

来源

If they differ, the script updates the certificate through OpenAPI.

来源

The guide includes troubleshooting API requests blocked by SafeLine.

来源