How to Install an ACME SSL Certificate on LiteSpeed

This guide covers everything you need to install ACME SSL certificates on LiteSpeed, including both OpenLiteSpeed and LiteSpeed Enterprise.

You’ll set up the ACME client, connect it to your certificate provider, request a secure certificate, and configure LiteSpeed to use it, all in just a few clear steps. Once complete, your certificates will renew automatically with no manual intervention required.

We’ll use ACME.sh, a lightweight and reliable tool that supports External Account Binding (EAB), required for commercial ACME SSLs from Sectigo and DigiCert.

---

What You’ll Need Before Starting

Make sure you’ve got these ready:

• LiteSpeed Web Server installed (OpenLiteSpeed or Enterprise)
• SSH access with root or sudo privileges
• Your domain’s A/AAAA DNS record pointing to this server
• An active ACME SSL subscription (from Sectigo or DigiCert)
• Your EAB credentials (KID + HMAC key)
• Port 80 open — the ACME challenge runs through plain HTTP
• Outbound internet access to your ACME provider’s endpoint

ACME endpoints to use:

• Sectigo: https://acme.sectigo.com/v2/DV
• DigiCert: https://acme.digicert.com/v2/acme

---

Step 1: Install ACME.sh

We’ll start by installing ACME.sh, the lightweight script that handles your certificate requests and renewals.

Open a terminal window (SSH) and connect to your LiteSpeed server as root. If you’re using a VPS or cloud server connect using:

ssh root@your-server-ip

Once you’re in, run the following commands to install ACME.sh:

curl https://get.acme.sh | sh
source ~/.bashrc
acme.sh --version

This downloads the script, sets up the environment, and confirms it installed correctly.

If the install fails:

• Ensure curl and git are installed on your server
• If something got stuck, re-run the install with –force

---

Step 2: Register Your ACME Account (with EAB)

This step links your ACME client to the CA using the EAB credentials from your subscription.

acme.sh --register-account \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid EAB_KID \
  --eab-hmac-key EAB_HMAC_KEY \
  --accountemail [email protected]

Replace the values with your real credentials. If you’ve already registered with the same EAB pair, no problem, ACME.sh will reuse the existing account.

If it fails, check:

• Are your EAB credentials correct?
• Can your server reach outbound HTTPS (port 443)?

---

Step 3: Set Up Webroot and Test HTTP Validation

ACME uses HTTP-01 challenges to verify domain ownership. That means your server needs to respond at: http://yourdomain.com/.well-known/acme-challenge/

That means the ACME client will drop a test file in a folder called .well-known, and your server must serve it over plain HTTP (port 80).

Where’s the webroot on your server?

It depends on what you’re running. On OpenLiteSpeed (fresh install), by default, the Web root is at /usr/local/lsws/Example/html.

On LiteSpeed Enterprise (WHM or manual config), Web root is wherever your domain points, often something like: /home/youruser/public_html

Create the validation folder and test file

In your document root (adjust the path to match yours), run:

mkdir -p /your/webroot/.well-known/acme-challenge
echo "ok" > /your/webroot/.well-known/acme-challenge/testfile
curl -I http://yourdomain.com/.well-known/acme-challenge/testfile

If you see HTTP/1.1 200 OK, your server is ready to answer ACME challenges.

What if you’re forcing HTTPS?

If your site automatically redirects HTTP to HTTPS, you need to make an exception for the ACME path so it can stay on HTTP during validation. Add this to your .htaccess file:

RewriteEngine On
# Let ACME validation go through
RewriteRule ^\.well-known/acme-challenge/ - [L]
# Redirect everything else to HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This makes sure the challenge works even if your site uses HTTPS.

Extra check: is port 80 open?

If validation fails, your server might not be listening on HTTP. Check your LiteSpeed listeners.

For OpenLiteSpeed:

1. Sign in to LiteSpeed WebAdmin: https://:7080
2. Navigate to Listeners > Default (this exists on fresh installs).
3. Set:
   • Port = 80
   • IP = ANY

For LiteSpeed Enterprise:

Log into WHM or WebAdmin, and make sure your domain is listening on port 80. If another service is using that port, run:

sudo lsof -i :80

Stop the conflicting process, then restart LiteSpeed.

---

Step 4: Issue Your SSL Certificate

Now it’s time to request your SSL certificate through the ACME client. You’ll run this command directly in your server’s terminal (SSH), the same place you installed ACME.sh earlier.

acme.sh --issue \
  -d yourdomain.com \
  -w /path/to/your/webroot \
  --server https://acme.yourca.com/v2/endpoint

Let’s break it down:

• acme.sh –issue – tells ACME.sh you want to issue a new certificate.
• -d yourdomain.com – your main domain name. You can add more -d flags for subdomains or the www version, like -d www.yourdomain.com.
• -w /path/to/your/webroot – the full path to your website’s document root.
• –server https://acme.yourca.com/v2/endpoint – replace this with your CA’s ACME URL:
  • Sectigo: https://acme.sectigo.com/v2/DV
  • DigiCert: https://acme.digicert.com/v2/acme

If it fails with errors like: “unauthorized”, “not delegated”, or “invalid response”, it usually means:

• The domain’s DNS A/AAAA record doesn’t point to this server yet.
• Your webroot path is wrong. ACME can’t find the challenge file.
• Port 80 is blocked or redirected to HTTPS.
• You used the wrong CA server URL for your product.

---

Step 5: Install the Certificate and Set Reload

Now we install the certificate and tell LiteSpeed to reload after renewals.

First, create a directory for the cert:

mkdir -p /usr/local/lsws/conf/cert/yourdomain.com

Then install it:

acme.sh --install-cert -d yourdomain.com \
  --key-file /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key \
  --fullchain-file /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.crt \
  --reloadcmd "/usr/local/lsws/bin/lswsctrl reload"

Fix permissions:

chmod 600 /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key
chown -R nobody:nogroup /usr/local/lsws/conf/cert/yourdomain.com

Replace nobody:nogroup with your actual LiteSpeed user and group if different.

---

Step 6: Configure HTTPS in LiteSpeed

Now that your certificate is installed, let’s connect it to LiteSpeed so your website loads over HTTPS.

For OpenLiteSpeed (WebAdmin panel)

1. Log in to the WebAdmin console. Visit: https://your-server-ip:7080
2. Create a secure HTTPS listener. In the left menu, go to: Listeners > Add > Then set the following:
   • Name: HTTPS
   • IP Address: ANY
   • Port: 443
   • Secure: Yes
     
     
3. Click Save.
4. After saving, click on your new HTTPS listener and go to the SSL tab.
5. Enter the full paths to the cert and key files you installed earlier and click Save again.
   • Private Key File: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key
   • Certificate File: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.crt
     
     
6. Still under the HTTPS listener, go to the Virtual Host Mappings tab.
7. Add a mapping like this:
   • Virtual Host: Example (Replace Example with your actual virtual host name if you changed it.)
   • Domains: *
     
     
8. To apply all changes, restart LiteSpeed. You can do this from WebAdmin: Actions > Graceful Restart

For LiteSpeed Enterprise

If you’re using LiteSpeed Enterprise (e.g. with WHM/cPanel), the steps are similar, but the layout may differ slightly.

1. Access WebAdmin or WHM
2. Either use the WebAdmin panel (same as above) or configure SSL through your hosting panel.
3. Assign the certificate and key paths
4. Wherever your domain’s virtual host is defined, set:
   • Private Key File: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.key
   • Certificate File: /usr/local/lsws/conf/cert/yourdomain.com/yourdomain.com.crt
5. Reload LiteSpeed
6. Apply the changes by running service lsws reload

That’s it. Once LiteSpeed reloads, your site will start serving traffic over HTTPS using the ACME certificate you installed.

---

Step 7: Check HTTPS and Auto-Renewal

Visit your site. You should see:

• Correct CN/SAN
• No browser warnings

Now check if ACME.sh added a cron job:

crontab -l

It should look like:

24 13 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

Manually test renewal:

acme.sh --renew -d yourdomain.com --force
tail -n 40 ~/.acme.sh/acme.sh.log

If your reload command is correct, LiteSpeed will pick up the new cert automatically.

---

Having Issues? Here’s What to Check

If something’s not working during issuance or renewal, these quick checks should solve it:

404 Not Found” on the challenge file

• Check the -w path you used. Is it pointing to the correct document root?
• Make sure the .well-known/acme-challenge/ folder exists inside that root
• Try accessing a test file manually over HTTP (curl or browser)

“Unauthorized” or “Not Delegated” errors

• Your DNS might not be pointing to the server yet. Check your A/AAAA records
• Double-check your CA –server URL
• Are you using the right EAB credentials from your SSL provider?

LiteSpeed didn’t reload after certificate renewal

If your certificate renewed but the site is still showing the old one, it usually means LiteSpeed didn’t reload automatically. Check which LiteSpeed version you’re using.

If you’re on OpenLiteSpeed, reload the server manually with:

/usr/local/lsws/bin/lswsctrl reload

If you’re on LiteSpeed Enterprise, use:

service lsws reload

Update your ACME.sh reload command so it runs the correct line after every renewal.

--reloadcmd "/usr/local/lsws/bin/lswsctrl reload"

This makes sure LiteSpeed automatically refreshes the certificate next time it renews.

---

You’re Done

You’ve now successfully installed an ACME SSL certificate on LiteSpeed, and set it up to renew automatically without any manual work. Your server is using secure EAB-based certificates, everything’s wired into LiteSpeed, and the reload happens silently after each renewal.