Latest News And Updates - Rad Web Hosting Blog

Learn how to enable LetsEncrypt SSL installation and renewal for cPanel DNSOnly. This post provides a guide for enabling automated LetsEncrypt SSL installation and renewal for cPanel DNSOnly servers. Prerequisites Access to cPanel DNSOnly Server: SSH access with root privileges. (See: Install cPanel DNSOnly) Installed Software: Ensure that certbot (Let’s Encrypt client) is installed on your server. DNS Configuration: Ensure the DNS records for the domain(s) are correctly configured and pointing to your server. Enable LetsEncrypt SSL Installation and Renewal for cPanel DNSOnly Securing your cPanel DNSOnly server with Let's Encrypt SSL certificates is a straightforward process. This guide walks you through the steps to enable LetsEncrypt SSL installation and renewal for cPanel DNSOnly server. Install Certbot Login to DNSOnly server via SSH. Update System Packages: Run the following command to update your server's package list: sudo dnf update -y Install EPEL Repository: Certbot is part of the EPEL repository. Install it using: sudo dnf install epel-release -y Install Certbot: Install Certbot by running: sudo dnf install certbot -y Obtain an SSL Certificate To generate an SSL certificate for a domain managed by your cPanel DNSOnly server: Run Certbot: Use the following command to generate the SSL certificate: sudo certbot certonly --standalone -d ns1.example.com Replace ns1.example.com with your actual domain name. Complete the Challenge: Certbot will validate your domain ownership through HTTP or DNS challenges. Follow the prompts and ensure port 80 is open for the HTTP challenge. Verify Certificate Installation: Certificates are stored in /etc/letsencrypt/live/ns1.example.com/. You can check the directory to confirm: ls -l /etc/letsencrypt/live/ns1.example.com/ Configure SSL for cPanel Services To use the certificate for cPanel services such as WHM, Webmail, etc.: Copy Certificate Files: Locate your certificates and key: /etc/letsencrypt/live/ns1.example.com/fullchain.pem /etc/letsencrypt/live/ns1.example.com/privkey.pem Install Certificates in cPanel DNSOnly: In WHM: Navigate to Home > Service Configuration > Manage Service SSL Certificates. For each service (cPanel/WHM/Webmail, Dovecot, Exim), upload the fullchain.pem as the certificate and privkey.pem as the key. Save Changes: Apply and save the configuration. Automate Certificate Renewal Let’s Encrypt certificates are valid for 90 days. Automate the renewal process to avoid downtime: Backup cPanel's Existing Certificates: Run: mkdir -p /root/cpanel-ssl-backup cp -a /var/cpanel/ssl/cpanel/ /root/cpanel-ssl-backup/cpanel-$(date +%Y%m%d-%H%M%S)/ Ensure no errors are reported. Build mycpanel.pem: Run: rm -f /var/cpanel/ssl/cpanel/mycpanel.pem cat \ /etc/letsencrypt/live/ns1.example.com/privkey.pem \ /etc/letsencrypt/live/ns1.example.com/fullchain.pem \ > /var/cpanel/ssl/cpanel/mycpanel.pem Protect It: chown root:root /var/cpanel/ssl/cpanel/mycpanel.pem chmod 600 /var/cpanel/ssl/cpanel/mycpanel.pem Restart cPanel Services: /scripts/restartsrv_cpsrvd Make Renewal Automatic: mkdir -p /etc/letsencrypt/renewal-hooks/deploy nano /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh Add the following: #!/bin/bash DOMAIN"ns1.example.com" LE_DIR"/etc/letsencrypt/live/${DOMAIN}" CPANEL_PEM"/var/cpanel/ssl/cpanel/mycpanel.pem" TMP_PEM"${CPANEL_PEM}.new" # Only proceed if required files exist. if ]; then echo "ERROR: Let's Encrypt certificate files not found." exit 1 fi # Build new cPanel PEM atomically. cat \ "${LE_DIR}/privkey.pem" \ "${LE_DIR}/fullchain.pem" \ > "${TMP_PEM}" || exit 1 chown root:root "${TMP_PEM}" chmod 600 "${TMP_PEM}" # Verify the resulting PEM before installing it. openssl pkey -in "${TMP_PEM}" -noout >/dev/null 2>&1 || { echo "ERROR: Private key validation failed." rm -f "${TMP_PEM}" exit 1 } openssl x509 -in "${TMP_PEM}" -noout >/dev/null 2>&1 || { echo "ERROR: Certificate validation failed." rm -f "${TMP_PEM}" exit 1 } mv -f "${TMP_PEM}" "${CPANEL_PEM}" # Restart cpsrvd so it loads the renewed certificate. /scripts/restartsrv_cpsrvd exit $? Save it and make it executable: chmod 700 /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh Set Up Cron Job: Add a cron job to automate renewal: EDITORnano crontab -e Add the following line: 0 3 * * * /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh This runs the renewal command daily at 3 AM and reloads cPanel services to apply renewed certificates. Monitor and Verify Monitor Renewals: Check logs to verify renewals: cat /var/log/letsencrypt/letsencrypt.log Verify Active Certificate: After renewal, confirm the updated certificate in WHM under Manage Service SSL Certificates. Check Existing Certificates: sudo certbot certificates Check Cert Archives: ls -l /etc/letsencrypt/archive/ Troubleshooting Firewall Issues: Ensure port 80 and 443 are open for HTTP and HTTPS traffic. Renewal Errors: Check logs at /var/log/letsencrypt/letsencrypt.log for detailed error messages. DNS Validation Issues: Verify that DNS records are correctly pointing to your server. By following these steps, you can enable Let's Encrypt SSL on your cPanel DNSOnly server and ensure certificates are renewed automatically. This enhances the security of your server and ensures compliance with modern web security standards. Conclusion You now know how to enable LetsEncrypt SSL installation and renewal for cPanel DNSOnly.

Rad Web Hosting Blog

Recent Posts

Nothing Found

My Feed at https://radwebhosting.com

Services

Categories

Recent Posts

Save on VPS Hosting!

We’re Social!

Rad Web Hosting Blog