Managing SSL certificates across multiple services can quickly become a repetitive maintenance task, especially when your web infrastructure includes a hosting control panel, a reverse proxy, and a Web Application Firewall (WAF).
If you're using 1Panel to manage SSL certificates and SafeLine WAF to protect your websites, you've probably encountered a common issue: certificates renew automatically in 1Panel, but the WAF may still be serving an older certificate.
Fortunately, this process can be automated using Python and SafeLine's OpenAPI.
The Problem: SSL Renewal Doesn't Always Mean SSL Deployment
Let's consider a typical self-hosted infrastructure:
- 1Panel manages websites and automatically renews SSL certificates.
- SafeLine WAF filters malicious traffic before requests reach your applications.
- Let's Encrypt provides free SSL certificates.
- A scheduled task handles routine infrastructure maintenance.
Even when 1Panel successfully renews a certificate, SafeLine might continue using the previously uploaded version.
This creates an unnecessary operational dependency: someone must manually upload the new certificate to the WAF.
For infrastructure administrators managing multiple domains, this is both inconvenient and error-prone.
A Better Approach: Automate Certificate Synchronization
Instead of manually replacing certificates, we can create a small Python automation that checks whether SafeLine's certificate matches the latest version stored by 1Panel.
The overall workflow is straightforward:
- 1Panel automatically renews an SSL certificate.
- The updated certificate and private key are saved locally.
- A Python script reads the certificate files.
- The script retrieves the currently configured certificate from SafeLine's API.
- Both certificates are compared using their serial numbers.
- If they differ, the script updates the certificate through OpenAPI.
This approach avoids unnecessary API updates and eliminates repeated manual uploads.
Why Compare Certificate Serial Numbers?
A simple automation might compare expiration dates or file modification timestamps.
However, these methods are not always reliable.
A certificate's serial number provides a more direct way to identify whether two certificates are the same.
With Python's cryptography library, extracting the serial number is straightforward:
from cryptography import x509
with open("/path/to/fullchain.pem", "rb") as f:
certificate = x509.load_pem_x509_certificate(f.read())
print(hex(certificate.serial_number))
The script can compare this value against the certificate currently stored in SafeLine.
If the values match, no update is necessary.
If they differ, the certificate can be replaced using the existing certificate ID.
This makes the synchronization process efficient and repeatable.
Using SafeLine's OpenAPI
SafeLine provides certificate management endpoints that can be used for automation.
The relevant API operations include:
| Method | Endpoint | Purpose |
|---|---|---|
| GET | /api/open/cert |
List certificates |
| GET | /api/open/cert/{id} |
Retrieve certificate details |
| POST | /api/open/cert |
Create or update certificates |
A Python script can interact with these endpoints using the requests library.
For manually managed certificates, the update request includes the existing certificate ID, certificate content, and private key.
An important detail is to preserve the existing certificate ID rather than creating a new certificate every time.
This prevents unnecessary certificate entries from accumulating in SafeLine.
The automation should also avoid modifying certificates managed internally through ACME.
Full Implementation and Configuration
I documented a working implementation that connects 1Panel certificate renewal with SafeLine WAF certificate management.
The guide includes:
- A complete Python synchronization script
- Support for multiple domains
- Certificate serial-number comparison
- SafeLine OpenAPI authentication
- Dry-run testing before applying changes
- Scheduled execution through 1Panel
- Troubleshooting API requests blocked by SafeLine
- Security considerations for API tokens
You can find the complete implementation here:
👉 Automating SafeLine WAF SSL Certificate Updates with 1Panel — Full Python Script and Setup Guide
The guide also explains how to handle an issue that may occur when the SafeLine management interface is protected by its own WAF.
Common Issue: HTTP 467 When Calling the API
One interesting challenge with this setup is that SafeLine can block automation requests to its own management interface.
In some configurations, API requests may return HTTP 467 rather than the expected API response.
This typically indicates that a WAF protection rule intercepted the request before it reached the API.
A practical solution is to create a narrowly scoped allow rule:
- Restrict the source to the automation server's public IP.
- Limit the permitted path to
/api/open/. - Avoid creating unrestricted exceptions for the entire management interface.
If a CDN or reverse proxy is involved, ensure SafeLine is configured to identify the real client IP correctly.
Avoid disabling TLS verification as a routine workaround. A properly trusted HTTPS endpoint is preferable.
Scheduling the Automation
Once the script is tested, it can run through 1Panel's scheduled task system.
A weekly schedule may be sufficient for many deployments, provided it runs after certificate renewal and the acceptable deployment delay is understood.
For more demanding environments, an event-triggered workflow or more frequent checks may be appropriate.
A good synchronization script should be idempotent: running it repeatedly should not cause unnecessary certificate changes.
Security Considerations
Certificate automation handles sensitive private keys and privileged API credentials.
Before deploying it to production:
- Keep API tokens outside publicly accessible source code.
- Restrict configuration file permissions.
- Use HTTPS with proper certificate validation.
- Limit access to SafeLine's management API.
- Avoid logging private keys or authentication tokens.
- Test the automation with a dry run before enabling updates.
Automation should reduce operational risk, not introduce new security vulnerabilities.
Final Thoughts
SSL certificate renewal is only one part of certificate lifecycle management.
When multiple services terminate HTTPS connections, renewed certificates must also be propagated to the components that actually serve them.
By combining 1Panel, Python, and SafeLine OpenAPI, you can build a lightweight certificate synchronization workflow without adding another complex infrastructure service.
For the complete working script and detailed configuration steps, see the original 1Panel and SafeLine WAF automation tutorial on SiteTalk.
If you're managing self-hosted infrastructure, this is a useful way to eliminate one more recurring maintenance task.
Top comments (1)
Just curious, how do you guys handle SSL cert renewals in your setups? 🤔
I've been using a Python script to sync certs from 1Panel to SafeLine WAF, and it's been working pretty well so far.
Do you guys automate this stuff too, or just update things manually? Anyone found a better way to do it? Would love to hear how you're handling it!