LiteSpeed SSL Automation Using ACME (acme.sh)

LiteSpeed Web Server (OpenLiteSpeed or LiteSpeed Enterprise) supports SSL/TLS certificate automation via ACME using the acme.sh client and External Account Binding (EAB) authentication.

This guide explains installation, certificate issuance, LiteSpeed configuration, and automatic renewal verification. Replace all example values with your own data.

LiteSpeed Web Server

Prerequisites:

• LiteSpeed Web Server installed (OpenLiteSpeed or LiteSpeed Enterprise)
• SSH access with root/sudo privileges
• DNS A/AAAA records pointing to the server
• Outbound access to ACME server (e.g. https://acme.sectigo.com/v2/DV)
• ACME credentials (EAB_KID and EAB_HMAC_KEY)
• HTTP listener on port 80 enabled

1. Install acme.sh

Install ACME client:

curl https://get.acme.sh | sh

Load environment and verify:

source ~/.bashrc
acme.sh --version

Note: if installation fails, ensure curl and git are installed on the server.

2. ACME Account Registration

Register ACME account using EAB credentials:

acme.sh --register-account \
--server https://acme.sectigo.com/v2/DV \
--eab-kid EAB_KID \
--eab-hmac-key EAB_HMAC_KEY \
--accountemail you@example.com

Parameters:

• SERVER – ACME server URL provided by CA
• EAB_KID – External Account Binding ID
• EAB_HMAC_KEY – HMAC key provided by CA
• accountemail – email for notifications

3. Issue Certificate (Webroot)

Issue SSL certificate:

acme.sh --issue \
-d yourdomain.com \
-d www.yourdomain.com \
-w /path/to/webroot \
--server https://acme.sectigo.com/v2/DV

Explanation:

• yourdomain.com – main domain
• -w – webroot path (e.g. /home/user/public_html)
• --server – ACME CA endpoint

4. Install Certificate in LiteSpeed

Create certificate directory:

mkdir -p /usr/local/lsws/conf/cert/yourdomain.com

Install certificate and enable auto-reload:

acme.sh --install-cert -d yourdomain.com \
--key-file /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key \
--fullchain-file /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.crt \
--reloadcmd "/usr/local/lsws/bin/lswsctrl reload"

Note: LiteSpeed will reload automatically after each renewal.

5. Configure HTTPS Listener (Port 443)

• Listeners → Add
• Port: 443
• Secure: Yes
• IP: ANY

SSL Settings:

• Private Key: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key
• Certificate: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.crt

Save and restart LiteSpeed.

6. Verification & Auto-Renew

Certificates renew automatically (~30 days before expiration).

Check cron job:

crontab -l

Example:

24 13 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

Force renewal test:

acme.sh --renew -d yourdomain.com --force

SSL Verification

• Open https://yourdomain.com
• Check certificate validity
• Confirm domain match

Troubleshooting

• Port 80 blocked – check firewall / lsof -i :80
• Unauthorized – verify EAB and ACME URL
• 404 challenge – check webroot path and permissions
• Standalone conflict – use webroot mode only