Environment Variable Reference

Unknown nonempty CERTONE_* settings are rejected with the variable name, so misspelled deployment settings cannot silently fall back to defaults.

Environment-variable mode applies one deployment template to all certificates associated with a node and is recommended for Docker. Run certone run --env or certone exec --env -- application-command with the variables below. check, doctor, status, diagnose, and sync --once also support --env. Setting CERTONE_NODE_ID without an explicit --config automatically selects this mode.

--env cannot be combined with --config. Use a configuration file for multiple application targets or different per-certificate deployment rules. A single template can automatically handle multiple certificates. Before installing a local system service, run certone init to save configuration; do not rely solely on temporary terminal environment variables.

Environment variable	Purpose / default
CERTONE_NODE_ID	Required platform node ID; associated certificates are discovered automatically
CERTONE_TOKEN	Required node Token
CERTONE_DEPLOY_TYPE	files (default), nginx, httpd, openresty, or synology
CERTONE_CERT_DIR	File output root; default ~/.certone/certificates
CERTONE_KEY_PATH / CERTONE_FULLCHAIN_PATH	Override output paths individually; each must contain {id}. Defaults are {id}/key.pem and {id}/fullchain.pem under the certificate root
CERTONE_STATE_DIR	Default ~/.certone/state; persist it and use a separate directory for each replica
CERTONE_DOMAINS	Optional comma-separated expected domains, checked against every associated certificate; usually leave empty when certificates cover different domains
CERTONE_CHECK_COMMAND / CERTONE_RELOAD_COMMAND / CERTONE_ROLLBACK_COMMAND	Override preset commands; an empty string disables the corresponding command. Executed in a local shell
CERTONE_COMMAND_TIMEOUT	Local command timeout; default 30s
CERTONE_VERIFY_ADDRESS / CERTONE_VERIFY_SERVER_NAME	Optional actual TLS address and hostname
CERTONE_VERIFY_CA_FILE	Optional private CA file for TLS verification
CERTONE_SYNC_INTERVAL	Default 1h; minimum 1m
CERTONE_LOG_LEVEL / CERTONE_LOG_FORMAT / CERTONE_LOG_FILE	Defaults: info / text / standard logging
CERTONE_ALLOW_HTTP	Default false; consider only for local platform-connection testing
CERTONE_DSM_URL / CERTONE_DSM_USERNAME	DSM address / username
CERTONE_DSM_PASSWORD	DSM account password
CERTONE_DSM_DESCRIPTION / CERTONE_DSM_CERTIFICATE_ID	Default description CertOne-{id} creates a separate name per certificate. An explicit existing DSM ID takes precedence and is suitable for only one associated certificate
CERTONE_DSM_CREATE / CERTONE_DSM_AS_DEFAULT	Creation is enabled by default with the default description template and no explicit DSM ID; setting as default is always false by default. Multiple automatically discovered certificates cannot all be DSM's default
CERTONE_DSM_CA_FILE / CERTONE_DSM_OTP	Private CA file / currently valid one-time code

nginx, httpd, and openresty provide validation and reload commands for their standard images. files only writes files by default; configure custom commands as needed. Default locations follow the runtime user's home directory: ~/.certone on Linux/macOS, %USERPROFILE%\.certone on Windows, and /root/.certone for a root container. Environment-variable mode does not write config.yaml or create a log file by default. Local Windows commands use PowerShell; configure IIS through the wizard or YAML.

Environment variables are not automatically saved as YAML. The Docker Deployment guide sets them directly with Dockerfile ENV instructions. After changing these values, rebuild the image and recreate the container with the same data volume. The Dockerfile and image contain the Token, so keep both private. People with container-management access can also inspect runtime environment variables. For shared images, supply credentials at runtime; recreate the container after changing them, since a restart does not reload an edited env file. Do not include credentials in public repositories or diagnostic screenshots. When using a configuration file, enter credentials directly in config.yaml, restrict access, and mount that file read-only.

docker --env-file and Compose .env use different syntax: the former reads values literally, without extra quotes; the latter interprets variables and comments, so single-quote passwords containing $ or #. In Container Manager, enter each variable directly.