To be specific, I am talking about using a LetsEncrypt (LE) cert for WHM itself, not a domain being managed by these tools.
I'm well aware that I could install Certbot and reconfigure the underlying web server by hand, but generally, I'm averse to doing this as I could see the changes being trivially overwritten at some point by WHM or cPanel (or flagged by a security addon). For instance, when I used WHM's change hostname function, a new certificate signed by cPanel Inc was automatically installed.
I'm already using the LetsEncrypt AutoSSL plugin, but it explicitly calls out:
The Let’s Encrypt™ provider plugin does not generate hostname certificates for your system’s services. It only generates SSL certificates for your cPanel accounts.
- The server's hostname is
- WHM is accessed from either
web1.example.com:2087. Either of these access methods presents a cPanel Inc. signed certificate for
- The underlying server is a VPS I have root access to.
- The server is authoritative for its own DNS (that is,
whm.example.com) all point to the same IP on the same VM.
example.comhas a cPanel account in WHM
cpanel.example.compoints at this account and uses the AutoSSL LE certificate
One note: The underlying server's CPanel/WHM was migrated from a shared hosting arrangement by the webhost's technical support team, so there may be vagaries in its configuration that are non-standard.
Basically, I want to stay within WHM's "happy path" if at all possible. If not, and I need to make changes behind its back to make this work, that's fine too.
In summary: What is the right way to get WHM to use a LE certificate?