Install on Linux or Docker

From version 1.4.0 the NeverLapse Cert server also runs on Linux and in Docker, with PostgreSQL as its database. Installing on Windows is unchanged: see Download and install.

What you need

  • Ubuntu 22.04 or 24.04, or Debian 12 or 13, x86-64, with systemd. A virtual machine is fine.
  • Root (sudo) to run the installer.
  • PostgreSQL: the installer sets it up from the distribution, or you point it at an existing PostgreSQL 14 or newer.

Install on Linux

  1. Download neverlapse-cert-<version>-linux-x64.tar.gz from your account and copy it to the server.
  2. Extract it and, in that folder, run: 
    sudo ./install.sh --host cert.example.com
    Use the DNS name people and agents will open NeverLapse by.
  3. Open https://cert.example.com/ and create the first administrator, the same as on Windows. See First sign-in and Get started.

Options:

  • --port N: the web console's HTTPS port. 443 by default. Agents use the same port. You can change it later under Settings > Server address.
  • --db "<PostgreSQL connection string>": use an existing PostgreSQL 14 or newer instead of installing one.
  • -y: don't ask questions.

If the server runs a firewall, open the web port in it. The console starts with a self-signed certificate (your browser warns until you replace it). Switch it under Settings > Web server certificate: upload a PFX, or use a certificate NeverLapse manages.

What gets installed

WhatWhere
Two systemd servicesneverlapse-cert (renewals, deployments, agents) and neverlapse-cert-web (the web console)
System usernlcert
Program/opt/neverlapse-cert-server
Data/var/lib/neverlapse-cert-server
Settings and secrets/etc/neverlapse-cert-server (root only, mode 600)
DatabasePostgreSQL from the distribution, unless you used --db
Logsjournalctl -u neverlapse-cert -u neverlapse-cert-web and /var/lib/neverlapse-cert-server/Logs

The NeverLapse agent can run on the same Linux server. It lives in /opt/neverlapse, separate from the server.

Upgrade

On 1.9.0 or newer: Settings > Updates > Install does it for you, with a backup and automatic rollback (Updates). By hand: download the new package, extract it and run sudo ./install.sh from it again. It upgrades in place and keeps the data, settings and database.

Uninstall

  1. Free the license first: Settings > License > Remove from this server.
  2. Run: 
    sudo /opt/neverlapse-cert-server/uninstall.sh
    This removes the program and keeps the data, settings and database, so reinstalling picks up where you left off. Add --purge to remove those too.

Run in Docker

The Linux package has a docker/ folder. From the extracted package folder:

  1. Build the image: 
    docker build -f docker/Dockerfile -t neverlapse-cert:$(cat VERSION) .
  2. Copy docker/docker-compose.yml and docker/.env.example into a folder of their own, and rename .env.example to .env.
  3. In .env, set:
    • NEVERLAPSE_HOSTNAME: the DNS name people and agents use.
    • DB_PASSWORD: make one up; it stays on this host.
    • NEVERLAPSE_PORT: 443 by default. It's the same port inside and outside the container.
  4. Start it: 
    docker compose up -d
  5. Open https://<NEVERLAPSE_HOSTNAME>/ and create the first administrator.
  • PostgreSQL 17 runs as a second container.
  • Data is kept in the volumes neverlapse-data and neverlapse-db. Back them up; don't remove them.
  • The host's /etc/machine-id is mounted read-only for licensing: one license is one server.
Changing the port in Docker: edit NEVERLAPSE_PORT in .env and run docker compose up -d again. Settings > Server address can't change the port in Docker.

Upgrade in Docker

In Docker, Settings > Updates shows when a new version is out but can't install it: upgrade on the Docker host.

  1. Download and extract the new package, and build its image (the tag is the new package's VERSION): 
    docker build -f docker/Dockerfile -t neverlapse-cert:$(cat VERSION) .
  2. In your .env, set NEVERLAPSE_VERSION to that version.
  3. Run docker compose up -d. The data in the volumes is kept.

Windows-only features

These need NeverLapse on a Windows server. On a Linux or Docker server they're hidden and refused:

  • Windows (domain-joined), Windows (workgroup) and Veeam Cloud Connect (push) hosts, which reach Windows over WMI and remote PowerShell. Instead, install the Windows agent on that server and use Windows - IIS (agent, pull), Windows - General (agent, pull), Veeam Cloud Connect (agent, pull), Microsoft Remote Desktop Services (agent, pull) or, for Exchange, Microsoft Exchange (agent, pull).
  • The Windows DNS provider. Use another DNS provider; Manual DNS works with any DNS host.

Everything else works the same: Let's Encrypt and the other certificate authorities, the GoDaddy, Cloudflare, Azure DNS, Amazon Route 53, Google Cloud DNS, Namecheap, IONOS, cPanel, DigitalOcean, DNS Made Easy, DNSimple, Name.com, BIND and Manual DNS providers (only Windows DNS is Windows-only), every agent host type (Windows and Linux Apache, nginx, HAProxy, Tomcat and General, VMware Cloud Director cells), OPNsense HAProxy, SSO and MFA, and licensing.

Next: open the console and create your first administrator. First sign-in and Get started.
Previous Download and install NextFirst sign-in and Get started