Install an ACME SSL certificate on cPanel hosting with acme.sh

On TopHost cPanel hosting you can use a Sectigo ACME subscription without root access: the acme.sh client runs inside your own account, obtains the certificate, installs it in cPanel through the cPanel API and renews it automatically from your cron jobs. All you need is the Terminal (or SSH) and the ACME credentials. If a free certificate is enough for you, there is nothing to install: AutoSSL handles it.

What you need

• A cPanel hosting account with Terminal or SSH access. If the Terminal icon is missing or SSH is not enabled for your account, ask us in a ticket.
• The Server URL, EAB MAC ID and EAB MAC Key from Sectigo ACME Certificate-as-a-Service.
• The domain already opens from our server over HTTP (its DNS points to the hosting account).
• The document root of the domain. In cPanel, open Domains in the Domains section: the Document Root column shows it. For the main domain it is usually /home/USERNAME/public_html, where USERNAME is your cPanel user name.

Step 1. Open a terminal

In cPanel, go to the Advanced section and click Terminal. The first time, confirm the warning with I understand and want to proceed. You can also connect from your computer with an SSH client, as described in connecting to the server via SSH.

Step 2. Install acme.sh

curl https://get.acme.sh | sh -s email=admin@example.com
source ~/.bashrc
acme.sh --version

acme.sh is installed in ~/.acme.sh/ and adds a daily job to your cron jobs. If the shell still answers acme.sh: command not found, log out and back in, or call it by its full path: ~/.acme.sh/acme.sh.

Step 3. Register the ACME account

Run this once, with your own values from the client area:

acme.sh --register-account \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_MAC_ID \
  --eab-hmac-key YOUR_EAB_MAC_KEY

To avoid typing the server URL in every later command, you can make it the default:

acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV

Step 4. Obtain the certificate

acme.sh --issue --server https://acme.sectigo.com/v2/DV \
  -d example.com -d www.example.com \
  -w /home/USERNAME/public_html

Use -d once for each name; every name must be in the domain list of your subscription. The path after -w is the document root from the Domains page. acme.sh places a temporary file in .well-known/acme-challenge/ inside that folder, the certificate authority reads it over HTTP, and the certificate is saved in ~/.acme.sh/.

Step 5. Install it in cPanel

acme.sh --deploy -d example.com --deploy-hook cpanel_uapi

The cpanel_uapi hook installs the certificate on the domain through the cPanel API, with no copy and paste. acme.sh remembers the hook, so after each renewal the new certificate is installed again by itself.

Step 6. Check the result

• In cPanel, open SSL/TLS and then Manage SSL sites: the domain should show the new certificate, its issuer and expiry date. SSL/TLS Status in the Security section shows the same at a glance.
• Open https://example.com in a browser and look at the certificate details behind the padlock.

AutoSSL normally leaves a valid certificate installed by you in place; it only steps in when a certificate is missing, invalid or about to expire.

Renewal

The daily cron job checks the certificates and renews them in good time before expiry. You can see the job in cPanel under Cron Jobs (a line containing acme.sh --cron); do not delete it. Useful commands:

acme.sh --list
acme.sh --renew -d example.com --force

The first lists your certificates and their next renewal date. The second forces a renewal immediately, which is a good way to test the whole chain once; avoid running it repeatedly.

If something goes wrong

• Verification fails with 404. The -w path is not the document root of that domain (typical for addon domains and subdomains), or a rule in .htaccess blocks the /.well-known/ folder.
• Verification fails with a timeout or a different IP. The domain does not yet point to our server. Check the nameservers or the A record and wait until the DNS change is visible.
• unauthorized or EAB errors at registration. The EAB MAC ID or key was copied incompletely, or the server URL is wrong.
• Domain not found or not issued yet when you run --deploy or --renew. Current acme.sh versions create ECC keys by default; if the command cannot find the certificate, add --ecc to it.
• The deploy step reports an error. Run it again with --debug added and send us the output in a ticket, without the EAB MAC Key.

The official acme.sh documentation is available at github.com/acmesh-official/acme.sh/wiki.

Related articles

• Sectigo ACME Certificate-as-a-Service: order and credentials
• Paid SSL certificate: order, validation and installation
• Missing or expired SSL certificate: how to get AutoSSL to issue it again
• Redirect http to https with .htaccess