2

To be specific, I am talking about using a LetsEncrypt (LE) cert for WHM itself, not a domain being managed by these tools.

I'm well aware that I could install Certbot and reconfigure the underlying web server by hand, but generally, I'm averse to doing this as I could see the changes being trivially overwritten at some point by WHM or cPanel (or flagged by a security addon). For instance, when I used WHM's change hostname function, a new certificate signed by cPanel Inc was automatically installed.

I'm already using the LetsEncrypt AutoSSL plugin, but it explicitly calls out:

The Let’s Encrypt™ provider plugin does not generate hostname certificates for your system’s services. It only generates SSL certificates for your cPanel accounts.

Configuration

  • The server's hostname is web1.example.com
  • WHM is accessed from either whm.example.com or web1.example.com:2087. Either of these access methods presents a cPanel Inc. signed certificate for web1.example.com
  • The underlying server is a VPS I have root access to.
  • The server is authoritative for its own DNS (that is, ns1.example.com and ns2.example.com and whm.example.com) all point to the same IP on the same VM.
  • example.com has a cPanel account in WHM
  • cpanel.example.com points at this account and uses the AutoSSL LE certificate

One note: The underlying server's CPanel/WHM was migrated from a shared hosting arrangement by the webhost's technical support team, so there may be vagaries in its configuration that are non-standard.

Basically, I want to stay within WHM's "happy path" if at all possible. If not, and I need to make changes behind its back to make this work, that's fine too.


In summary: What is the right way to get WHM to use a LE certificate?

4
  • Could you add a cPanel account for whm.example.com so that AutoSSL could fetch the certificate? Then I'd think it would just be a matter of symlinks. Jan 11 at 9:31
  • @MikeCiffone: This is an AutoSSL for older versions of WHM and doesn't appear to be relevant to the problem.
    – Mikey T.K.
    Jan 11 at 14:45
  • @StephenOstermiller: Tried it; doing so breaks access to WHM (in that whm.example.com stops pointing to it and starts pointing to a new account skeleton). I deleted it with no issue, and did see that AutoSSL did get a LE cert.
    – Mikey T.K.
    Jan 11 at 14:47
  • @MikeyT.K. You're right I misunderstood, but also yeah outdated. My mistake. Jan 11 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.