Manual Installation
This page covers manual downloads, SHA256 verification, and custom installation directories. For the one-line installer, see Quick Start.
Install in your user directory
On Linux/macOS, install into a writable directory you own without sudo:
export CERTONE_INSTALL_DIR="$HOME/.local/bin"
sh -c "$(curl -fsSL https://certone.io/downloads/certone/install.sh)"
export PATH="$HOME/.local/bin:$PATH"
certone version
The PATH change applies to the current terminal. Add the directory to your shell configuration for persistent use. Application deployment permissions depend on the runtime account.
All local configuration and credentials are stored in ~/.certone/config.yaml, or %USERPROFILE%\.certone\config.yaml on Windows. certone init, check, run, and other commands use this location by default; --config selects another file. Default initialization does not require administrator privileges.
Select a package
Obtain the package and checksum file from your platform's download page or administrator:
| Runtime environment | Package |
|---|---|
| Linux, x86_64 / AMD64 | certone_linux_amd64.tar.gz |
| Linux, ARM64 / aarch64 | certone_linux_arm64.tar.gz |
| macOS, Intel | certone_darwin_amd64.tar.gz |
| macOS, Apple Silicon | certone_darwin_arm64.tar.gz |
| Windows, x64 | certone_windows_amd64.zip |
Use uname -m on Linux/macOS to check the architecture. Docker images require Linux packages, even when built on macOS or Windows. Do not copy a host executable into a Linux image.
Verify the SHA256 checksum after downloading, for example:
# Linux
sha256sum certone_linux_amd64.tar.gz
# macOS
shasum -a 256 certone_darwin_arm64.tar.gz
# Windows
Get-FileHash .\certone_windows_amd64.zip -Algorithm SHA256
Compare the result exactly with the corresponding entry in the provider's SHA256SUMS file. If you downloaded only one package, checking a manifest that lists several packages may report missing files. That does not mean the downloaded file failed verification.
Install on Linux
This example uses amd64. Run it from the download directory. sudo install writes the executable to the protected /usr/local/bin directory; extraction and version checks do not require administrator privileges. Omit sudo when installing in a writable user directory; see ordinary user setup.
tar -xzf certone_linux_amd64.tar.gz
sudo install -m 0755 certone_linux_amd64/certone /usr/local/bin/certone
certone version
Output containing the version and linux amd64 confirms that the program can run. For ARM64, replace the package and directory names.
Install on macOS
This example uses Apple Silicon. sudo mkdir and sudo install create or write to the system command directory, /usr/local/bin. They do not mean CertOne must run as an administrator:
tar -xzf certone_darwin_arm64.tar.gz
sudo mkdir -p /usr/local/bin
sudo install -m 0755 certone_darwin_arm64/certone /usr/local/bin/certone
certone version
Intel users should use darwin_amd64. If the terminal cannot find the command, try /usr/local/bin/certone version, then check PATH.
nginx and OpenResty paths on macOS may differ from Linux. Use commands such as command -v nginx before configuring them. For background operation, see Background Services.
Install on Windows
Use an administrator PowerShell session and choose a permanent executable location. These commands write to protected Program Files and prepare a ProgramData directory and permissions for system-service deployment, so administrator privileges are required:
Expand-Archive .\certone_windows_amd64.zip -DestinationPath .\certone-unpacked
New-Item -ItemType Directory -Force 'C:\Program Files\CertOne'
Copy-Item .\certone-unpacked\certone_windows_amd64\certone.exe 'C:\Program Files\CertOne\certone.exe'
& 'C:\Program Files\CertOne\certone.exe' version
New-Item -ItemType Directory -Force 'C:\ProgramData\CertOne'
icacls 'C:\ProgramData\CertOne' /inheritance:r /grant:r '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F'
The final command removes inherited permissions from the new directory and grants access to SYSTEM and the Administrators group. If the directory already exists, inspect other explicit permissions and subdirectory permissions too. Grant any other runtime account the access it needs. Manage Windows permissions through ACLs; Unix chmod 600 is not equivalent protection on Windows.
The default configuration remains %USERPROFILE%\.certone\config.yaml. The ProgramData directory above is an option for administrator-managed system deployments; explicitly pass --config when using it. See Windows IIS Deployment for a complete example.