3

To be specific, I am talking about using a LetsEncrypt (LE) cert for WHM itself, not a domain being managed by these tools.

I'm well aware that I could install Certbot and reconfigure the underlying web server by hand, but generally, I'm averse to doing this as I could see the changes being trivially overwritten at some point by WHM or cPanel (or flagged by a security addon). For instance, when I used WHM's change hostname function, a new certificate signed by cPanel Inc was automatically installed.

I'm already using the LetsEncrypt AutoSSL plugin, but it explicitly calls out:

The Let’s Encrypt™ provider plugin does not generate hostname certificates for your system’s services. It only generates SSL certificates for your cPanel accounts.

Configuration

  • The server's hostname is web1.example.com
  • WHM is accessed from either whm.example.com or web1.example.com:2087. Either of these access methods presents a cPanel Inc. signed certificate for web1.example.com
  • The underlying server is a VPS I have root access to.
  • The server is authoritative for its own DNS (that is, ns1.example.com and ns2.example.com and whm.example.com) all point to the same IP on the same VM.
  • example.com has a cPanel account in WHM
  • cpanel.example.com points at this account and uses the AutoSSL LE certificate

One note: The underlying server's CPanel/WHM was migrated from a shared hosting arrangement by the webhost's technical support team, so there may be vagaries in its configuration that are non-standard.

Basically, I want to stay within WHM's "happy path" if at all possible. If not, and I need to make changes behind its back to make this work, that's fine too.

In summary: What is the right way to get WHM to use a LE certificate?

Improve this question
4
  • Could you add a cPanel account for whm.example.com so that AutoSSL could fetch the certificate? Then I'd think it would just be a matter of symlinks.
    – Stephen Ostermiller ♦
    Commented Jan 11, 2022 at 9:31
  • @MikeCiffone: This is an AutoSSL for older versions of WHM and doesn't appear to be relevant to the problem.
    – Mikey T.K.
    Commented Jan 11, 2022 at 14:45
  • @StephenOstermiller: Tried it; doing so breaks access to WHM (in that whm.example.com stops pointing to it and starts pointing to a new account skeleton). I deleted it with no issue, and did see that AutoSSL did get a LE cert.
    – Mikey T.K.
    Commented Jan 11, 2022 at 14:47
  • @MikeyT.K. You're right I misunderstood, but also yeah outdated. My mistake.
    – Mike Ciffone
    Commented Jan 11, 2022 at 17:59

1 Answer 1

Reset to default
1

A somewhat new plug-in named FleetSSL explicitly offers the ability to request and install LE certificates for cPanel services.

Improve this answer
2
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Oct 26, 2022 at 4:21
  • Supporting information as follows: this plug-in exists and directly solves the problem as I described it. It was linked to. No further information is relevant or necessary.
    – Mikey T.K.
    Commented Oct 26, 2022 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.