Skip to content

Simple guide to add TLS cert to cpanel

chlorenz edited this page Jun 6, 2022 · 21 revisions
Clone this wiki locally

How to use with cPanel for automatically renewing Let's Encrypt SSL

This guide will demonstrate how to use with a cPanel account to setup automatically renewing Let's Encrypt certificates.

Prerequisites: SSH access to your cPanel account is required. Contact your host to find out whether this is available. Sometimes they will enable it on request.

In the example commands below, make the following substitutions:

Variable Substitute With Example Value
_EXAMPLE.COM_ The domain name you want an SSL certificate for.
_CPANEL_USERNAME_ The username you use to login to cPanel user123
_SSH_PORT_ The port number you use to connect to SSH (ask your cPanel provider) 22
_SSH_ADDRESS_ The server address you use to connect to SSH (ask your cPanel provider)

1. Setting up in cPanel.

Login to your cPanel account via SSH:


Install with the following command:

curl | sh

Log-off and login to SSH again, or run the following command:

source ~/.bashrc

Tell to set Let's Encrypt as the default CA server (required since Aug 2021): --set-default-ca  --server  letsencrypt

Register a Let's Encrypt account with your email, so you can be notified of any renewal issues: --register-account --accountemail

And confirm that has setup a cron job for automatic renewals:

crontab -l | grep

# The above command should output something like the below:
10 0 * * * "/home/_CPANEL_USERNAME_/"/ --cron --home "/home/_CPANEL_USERNAME_/" > /dev/null

2. Issuing a test certificate for your domain.

We will use the webroot method, which requires you to enter the document root of your domain. The webroot for your main domain is ~/public_html, but addon domains and subdomains will be located in other directories.

(Click to see how you can locate the webroot for a domain using the uapi command)
uapi DomainInfo single_domain_data domain=_EXAMPLE.COM_ | grep documentroot

Try issue a test certificate now: --issue --webroot ~/public_html -d _EXAMPLE.COM_ --staging

If this domain has alias/parked domains, include those with additional -d parameters, such as: --issue --webroot ~/public_html -d -d --staging

Ensure that this step is successful. If you encountered an error, ensure that the webroot is correct, or try to run with --debug 2 for further information.

3. Issuing a real certificate for your domain.

Use the same parameters as for your test certificate, except replace --staging with --force: --issue --webroot ~/public_html -d _EXAMPLE.COM_ --force

This re-issues the certificate as a real, trusted SSL certificate, rather than a test one from the staging environment.

4. Installing your certificate to your cPanel account.

After issuing the real certificate, we need to tell how to install it to our domain, so it can automatically perform that task at every renewal. --deploy --deploy-hook cpanel_uapi --domain _EXAMPLE.COM_

This should result in a success message:

[Tue Aug  6 03:56:25 EDT 2019] Certificate successfully deployed
[Tue Aug  6 03:56:25 EDT 2019] Success

You should now be able to visit your domain in your browser and see that it is protected by a Let's Encrypt certificate.

Please note, this will only deploy to a single virtualhost in your cPanel account. For other addon and subdomains, you should create separate certificates..

5. Redirecting HTTP to HTTPS for your domain (Optional).

To automatically redirect insecure HTTP traffic to HTTPS, please enable Force HTTPS Redirection in cPanel: