SSL certificate on LiteSpeed and OpenLiteSpeed with acme.sh (ACME)

On a VPS or dedicated server running OpenLiteSpeed or a standalone LiteSpeed Enterprise, you can get a Sectigo certificate from your ACME subscription with acme.sh, point LiteSpeed to the files once and let acme.sh renew the certificate and restart the web server by itself. This guide shows each step, from installing acme.sh to the HTTPS listener in WebAdmin.

It is not meant for TopHost WordPress Hosting and Business Hosting: there LiteSpeed is managed by cPanel, the free certificate comes from AutoSSL, and an ACME certificate is installed as in acme.sh on cPanel hosting. The same applies to LiteSpeed Enterprise running under any control panel: use the panel's SSL tools.

Requirements

• Root or sudo access over SSH (see connecting via SSH).
• The domain's A and, if used, AAAA records point to the server.
• A virtual host for the site that already answers on port 80.
• Ports 80 and 443 open in the firewall. Leave the WebAdmin port 7080 reachable only from your own IP address.
• The Server URL, EAB MAC ID and EAB MAC Key from Sectigo ACME Certificate-as-a-Service.

Step 1. Install acme.sh

curl https://get.acme.sh | sh -s email=admin@example.com
source ~/.bashrc
acme.sh --version

If the download fails, install curl (and socat or cron, if the installer asks for them) with the system package manager and run the command again.

Step 2. Register with the Sectigo ACME server

acme.sh --register-account \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_MAC_ID \
  --eab-hmac-key YOUR_EAB_MAC_KEY \
  --accountemail admin@example.com

This is done once per server. The --accountemail address receives notices about the account.

Step 3. Find the document root and issue the certificate

In WebAdmin, open Virtual Hosts, select the site and look at Document Root on the General tab. On a clean OpenLiteSpeed it is /usr/local/lsws/Example/html; under CyberPanel it is usually /home/example.com/public_html. Then:

acme.sh --issue --server https://acme.sectigo.com/v2/DV \
  -d example.com -d www.example.com \
  -w /home/example.com/public_html

Use the webroot mode shown here rather than standalone mode: standalone tries to start its own web server on port 80, which LiteSpeed already occupies.

Step 4. Copy the certificate to a fixed place

mkdir -p /usr/local/lsws/conf/cert/example.com
acme.sh --install-cert -d example.com \
  --key-file /usr/local/lsws/conf/cert/example.com/privkey.pem \
  --fullchain-file /usr/local/lsws/conf/cert/example.com/fullchain.pem \
  --reloadcmd "/usr/local/lsws/bin/lswsctrl restart"

acme.sh copies the key and the full chain to that folder now and after every renewal, then runs the reload command. lswsctrl restart performs a graceful restart, so open connections are not dropped. Never point LiteSpeed directly to files inside ~/.acme.sh/; their layout may change between versions.

Step 5. Enable HTTPS in WebAdmin

Open WebAdmin at https://SERVER_IP:7080 and sign in.

1. Go to Listeners and add a new listener: a name such as HTTPS, IP Address ANY, Port 443, Secure Yes. Save.
2. Open the new listener and the SSL tab. Under SSL Private Key and Certificate set Private Key File to /usr/local/lsws/conf/cert/example.com/privkey.pem, Certificate File to /usr/local/lsws/conf/cert/example.com/fullchain.pem and Chained Certificate to Yes. Save.
3. On the Virtual Host Mappings tab, add your virtual host and the domains example.com, www.example.com.
4. Click Graceful Restart.

Hosting several sites with their own certificates on one server? Keep one HTTPS listener and set the key and certificate on the SSL tab of each virtual host instead; LiteSpeed chooses the right certificate by the requested name.

CyberPanel writes its own configuration for the sites it manages and may replace manual changes made in WebAdmin. On CyberPanel, check after a panel update or a change to the site that the SSL paths are still yours.

Step 6. Check HTTPS and renewal

• Open https://example.com and check the certificate behind the padlock: the issuer, the names covered and the expiry date.
• Run crontab -l: there should be a line with acme.sh --cron, which checks the certificates every day.
• Run acme.sh --list to see the certificates and their next renewal date.
• To test the full chain once (renewal, copy, restart), run acme.sh --renew -d example.com --force.

Troubleshooting

• Timeout during validation. Port 80 is blocked by the firewall or the DNS record still points elsewhere. On the server, ss -tlnp | grep ':80 ' shows whether LiteSpeed is listening.
• 404 for the challenge file. The -w path is not the document root of that virtual host, or a rewrite rule redirects /.well-known/acme-challenge/.
• unauthorized at registration. Check the EAB MAC ID, EAB MAC Key and server URL, copied without spaces.
• The site still shows the old or a default certificate. The listener or virtual host points to other files, the domain is missing from the Virtual Host Mappings, or LiteSpeed was not restarted.
• Domain not found when running --renew or --install-cert. Add --ecc: current acme.sh versions issue ECC certificates by default.

On a managed VPS from TopHost you can ask us to do this setup. Otherwise, if you get stuck, open a ticket with the command and the full output, without the EAB MAC Key.

Related articles

• Sectigo ACME Certificate-as-a-Service: order and credentials
• Certbot on Apache and Nginx
• acme.sh on cPanel hosting