Web Hosting Journal
To uninstall the Cpanel / WHM plugin for Let’s Encrypt, login to your SSH for root and run the following:
/usr/local/cpanel/scripts/uninstall_lets_encrypt_autossl_provider
It might take sometime, once completed, it should remove let’s encrypt as a provider from your AutoSSL plugin.
Let’s Encrypt is a popular tool to use free SSL for your website. Cpanel comes with Sectigo free ssl service through requesting and pooling system. Although, you might feel interested in getting the SSL released immediately without a queue based approach, and would prefer to use Let’s Encrypt that’s why.
There are two ways, you may install Let’s Encrypt in Cpanel.
First one would be using the plugin created by Cpanel. Login to your server as root:
ssh root@server_ip
Then, run the following to install Let’s Encrypt in your cpanel system
/usr/local/cpanel/scripts/install_lets_encrypt_autossl_provider
It might take a couple of minutes, then it should install Let’s Encrypt as a provider in AutoSSL.
Now, go to WHM >> Manage AutoSSL and select Let’s Encrypt as the provider instead of Sectigo Cpanel default. You need to check the Agreement rules under the Let’s Encrypt selection and you may create the account in Let’s Encrypt using the same tool.
Once done, your new SSLs would be issued using the Let’s Encrypt tool through Cpanel AutoSSL plugin.
2. Using FleetSSL
There is a 3rd party tool, existed before Cpanel provided a plugin for Let’s Encrypt. It’s FleetSSL. One key benefit of using FleetSSL is that, it allows the Cpanel end users to control issuing and renewing the SSL from Cpanel. One key cons of using FleetSSL is that, it is not free of charge, it comes with 30$ one time fees. But mainly hosting provider would not mind to use this as it is a nice addition for the end user feature set in a hosting provider’s point of view.
You may check for details here:
https://letsencrypt-for-cpanel.com/
Now, once you complete installing Let’s Encrypt SSL, you may now use Let’s Encrypt for different cpanel services like webmail/cpanel/whm/calenders/MTA services. You may check the following to know how to:
hmm, it’s a weird topic to write blog on. Because Cyberpanel comes with a built in Certbot, and can automatically detects www and without www to install SSL for. Then why am I writing this up? All because I found a VPS client today facing the issue. Even though, Cyberpanel was telling me that the SSL is issued, it was only issued for non-www domain, but the www domain left behind. Let’s see how can we resolve this.
First problem
First problem came up when I tried to discover the Cyberpanel certbot binaries.
[root@server-sg /]# find . -name "certbot" ./usr/local/CyberCP/bin/certbot ./usr/local/CyberCP/lib/python3.6/site-packages/certbot ./usr/local/CyberPanel/bin/certbot ./usr/local/CyberPanel/lib/python3.6/site-packages/certbot [root@server-sg live]# /usr/local/CyberCP/bin/certbot --version certbot 0.21.1 [root@server-sg live]# /usr/local/CyberPanel/bin/certbot --version certbot 0.21.1
Both of the certbot I could find from Cyberpanel was very old, Certbot has 1.4 version in the Epel which has support for Acme 2 challenge, while the one that Cyberpanel is using doesn’t. I hence decided to install a certbot for our case:
yum install epel-release yum install certbot
These should be it for the latest version of certbot to start working in your Cyberpanel host. Once done, you may now generate the SSL using the following:
certbot certonly --webroot -w /home/yourdomain.com/public_html -d yourdomain.com -d www.yourdomain.com
Remember to replace yourdomain.com with the actual one that is having problem with. Cyberpanel creates the home directory with the primary domain, so the remember to give the correct document root for the value of attribute ‘-w’.
Once this id done, certbot should automatically verify the challenge and get the issued license for you. Lets encrypt license are usually stored at the following directory:
/etc/letsencrypt/live/yourdomain.com/ Files are: /etc/letsencrypt/live/yourdomain.com/privatekey.pem /etc/letsencrypt/live/yourdomain.com/fullchain.pem
If you had already created the SSL using Cyberpanel (which you must have done if you viewing this post), then remember, certbot will place the SSLs in /etc/letsencrypt/live/yourdomain.com-001/ folder. The name of the folder would be shown at the time you complete issuing SSL with certbot.
There are couple of ways you may use the SSL now. Either you may replace the old directory with the new, or just change the settings in either the vhost conf or the openlitespeed SSL settings. I find the easiest way is just to replace the old directory with the new. Something like this should work:
mv /etc/letsencrypt/live/yourdomain.com /etc/letsencrypt/live/old_yourdomain.com mv /etc/letsencrypt/live/yourdomain.com-001 /etc/letsencrypt/live/yourdomain.com
Once this is done, remember to restart your openlitespeed:
service lsws restart
Now your https on the WWW should work without any problem. If not, try clearing your browser cache and retry.
Note: This does not seem to work on 2021. I have written another article on how to do this now: How to manually install/renew let’s encrypt ssl in Zimbra
Ok, there is a reason to put 2020 on the title. Because the process has changed since past. At this moment, I manage a Zimbra server with multiple domains in it, which won’t deploy the ‘other’ domains if not specified. The process is fairly simple, but I am keeping this as a documentation purpose, so that I don’t miss next time.
To renew the certificate for attached domains using certbot is fairly simple, just do:
# certbot renew
Once done, you you want to use the pre-hook and deploy-hook to do the patching and deploying as following using certbot_zimbra.sh
# certbot_zimbra.sh -p
# certbot_zimbra.sh -r -d 'your_domain'
Updated, certbot_zimbra doesn’t take this. ‘-n’ used to be taken as new and ‘-r’ for replacing, now, ‘-r’ is removed. Instead you can use ‘-e’ to specify new domains. So the command for replacement and deployment would be fairly simple as following:# certbot_zimbra.sh -p
# certbot_zimbra.sh -d -e 'mail.yourdomain.com'
# certbot_zimbra.sh -d -e 'mailapp.yourdomain.com'
… and so on. At this moment, I couldn’t find a way to advise zimbra certbot to follow a list of domains instead of one. But this is probably possible by cracking the certbot.