LetsEncrypt SSL Installation and Renewal for cPanel DNSOnly (Simple 5-Minute Guide)

This post provides a guide for enabling automated LetsEncrypt SSL installation and renewal for cPanel DNSOnly servers.

Prerequisites

• Access to cPanel DNSOnly Server: SSH access with root privileges. (See: Install cPanel DNSOnly)
• Installed Software: Ensure that certbot (Let’s Encrypt client) is installed on your server.
• DNS Configuration: Ensure the DNS records for the domain(s) are correctly configured and pointing to your server.

Enable LetsEncrypt SSL Installation and Renewal for cPanel DNSOnly

Securing your cPanel DNSOnly server with Let’s Encrypt SSL certificates is a straightforward process. This guide walks you through the steps to enable LetsEncrypt SSL installation and renewal for cPanel DNSOnly server.

1. Install Certbot

   1. Login to DNSOnly server via SSH.
   2. Update System Packages:
      Run the following command to update your server’s package list:

      sudo dnf update -y
      

   3. Install EPEL Repository:
      Certbot is part of the EPEL repository. Install it using:

      sudo dnf install epel-release -y
      

   4. Install Certbot:
      Install Certbot by running:

      sudo dnf install certbot -y
      

2. Obtain an SSL Certificate

   To generate an SSL certificate for a domain managed by your cPanel DNSOnly server:

   1. Run Certbot:
      Use the following command to generate the SSL certificate:

      See Also: ✅ (Solved) How to Fix PHP Warning: Module ‘imagick’ already loaded Error

      sudo certbot certonly --standalone -d ns1.example.com
      

      Replace ns1.example.com with your actual domain name.

   2. Complete the Challenge:
      Certbot will validate your domain ownership through HTTP or DNS challenges. Follow the prompts and ensure port 80 is open for the HTTP challenge.
   3. Verify Certificate Installation:
      Certificates are stored in /etc/letsencrypt/live/ns1.example.com/. You can check the directory to confirm:

      ls -l /etc/letsencrypt/live/ns1.example.com/
      

3. Configure SSL for cPanel Services

   To use the certificate for cPanel services such as WHM, Webmail, etc.:

   1. Copy Certificate Files:
      Locate your certificates and key:

      /etc/letsencrypt/live/ns1.example.com/fullchain.pem
      /etc/letsencrypt/live/ns1.example.com/privkey.pem
      

   2. Install Certificates in cPanel DNSOnly:
      In WHM:
      • Navigate to Home > Service Configuration > Manage Service SSL Certificates.
      • For each service (cPanel/WHM/Webmail, Dovecot, Exim), upload the fullchain.pem as the certificate and privkey.pem as the key.
   3. Save Changes:
      Apply and save the configuration.

4. Automate Certificate Renewal

   Let’s Encrypt certificates are valid for 90 days. Automate the renewal process to avoid downtime:

   1. Backup cPanel’s Existing Certificates:
      Run:

      mkdir -p /root/cpanel-ssl-backup
      cp -a /var/cpanel/ssl/cpanel/ /root/cpanel-ssl-backup/cpanel-$(date +%Y%m%d-%H%M%S)/
      

      Ensure no errors are reported.

   2. Build mycpanel.pem:
      Run:

      rm -f /var/cpanel/ssl/cpanel/mycpanel.pem
      cat \
        /etc/letsencrypt/live/ns1.example.com/privkey.pem \
        /etc/letsencrypt/live/ns1.example.com/fullchain.pem \
        > /var/cpanel/ssl/cpanel/mycpanel.pem

   3. Protect It:

      chown root:root /var/cpanel/ssl/cpanel/mycpanel.pem
      chmod 600 /var/cpanel/ssl/cpanel/mycpanel.pem

   4. Restart cPanel Services:

      /scripts/restartsrv_cpsrvd

   5. Make Renewal Automatic:

      mkdir -p /etc/letsencrypt/renewal-hooks/deploy
      nano /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh

      Add the following:

      #!/bin/bash
      
      DOMAIN="ns1.example.com"
      LE_DIR="/etc/letsencrypt/live/${DOMAIN}"
      CPANEL_PEM="/var/cpanel/ssl/cpanel/mycpanel.pem"
      TMP_PEM="${CPANEL_PEM}.new"
      
      # Only proceed if required files exist.
      if [[ ! -r "${LE_DIR}/privkey.pem" || ! -r "${LE_DIR}/fullchain.pem" ]]; then
          echo "ERROR: Let's Encrypt certificate files not found."
          exit 1
      fi
      
      # Build new cPanel PEM atomically.
      cat \
          "${LE_DIR}/privkey.pem" \
          "${LE_DIR}/fullchain.pem" \
          > "${TMP_PEM}" || exit 1
      
      chown root:root "${TMP_PEM}"
      chmod 600 "${TMP_PEM}"
      
      # Verify the resulting PEM before installing it.
      openssl pkey -in "${TMP_PEM}" -noout >/dev/null 2>&1 || {
          echo "ERROR: Private key validation failed."
          rm -f "${TMP_PEM}"
          exit 1
      }
      
      openssl x509 -in "${TMP_PEM}" -noout >/dev/null 2>&1 || {
          echo "ERROR: Certificate validation failed."
          rm -f "${TMP_PEM}"
          exit 1
      }
      
      mv -f "${TMP_PEM}" "${CPANEL_PEM}"
      
      # Restart cpsrvd so it loads the renewed certificate.
      /scripts/restartsrv_cpsrvd
      
      exit $?

      Save it and make it executable:

      See Also: How to Install Pleroma on Ubuntu VPS (5 Minute Quick-Start Guide)

      chmod 700 /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh

   6. Set Up Cron Job:
      Add a cron job to automate renewal:

      EDITOR=nano crontab -e
      

      Add the following line:

      0 3 * * * /etc/letsencrypt/renewal-hooks/deploy/update-cpanel-ssl.sh
      

      This runs the renewal command daily at 3 AM and reloads cPanel services to apply renewed certificates.

5. Monitor and Verify

   1. Monitor Renewals:
      Check logs to verify renewals:

      cat /var/log/letsencrypt/letsencrypt.log
      

   2. Verify Active Certificate:
      After renewal, confirm the updated certificate in WHM under Manage Service SSL Certificates.
   3. Check Existing Certificates:

      sudo certbot certificates

   4. Check Cert Archives:

      ls -l /etc/letsencrypt/archive/

Troubleshooting

• Firewall Issues: Ensure port 80 and 443 are open for HTTP and HTTPS traffic.
• Renewal Errors: Check logs at /var/log/letsencrypt/letsencrypt.log for detailed error messages.
• DNS Validation Issues: Verify that DNS records are correctly pointing to your server.

By following these steps, you can enable Let’s Encrypt SSL on your cPanel DNSOnly server and ensure certificates are renewed automatically. This enhances the security of your server and ensures compliance with modern web security standards.

Conclusion

You now know how to enable LetsEncrypt SSL installation and renewal for cPanel DNSOnly.