Auto SSL with acme.sh

acme.sh is a single shell script with no dependencies that runs on any Linux, FreeBSD and inside containers. It fully supports ACME with external account binding (EAB), so it works with Auto SSL out of the box. We also use this guide as the basis for the ISPmanager, FastPanel, cPanel and BitrixVM articles.

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (you can order it on the Auto SSL page).
2. Click "Configure Now" and enter your domains: regular ones in "Single Domains" (www and non-www count as one domain), wildcards in "Wildcard Domains".
3. In 5–30 seconds the service card shows ACME account ID, EAB MAC ID, EAB MAC key and Server URL.

Below: Server URL is https://acme.sectigo.com/v2/DV (shared by all customers), YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key. Keep them like a password.

Installing acme.sh

As root (or as a user who can write to the site directories and reload the web server):

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc
acme.sh --version

The installer puts the script into ~/.acme.sh/ and adds a cron job that checks expiry dates daily and renews certificates. Verify with crontab -l | grep acme.sh.

Registering the account with EAB keys

acme.sh --register-account --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY

This is done once: acme.sh stores the account in ~/.acme.sh/ca/acme.sectigo.com/ and the keys are not needed again. To avoid typing --server in every command, make Sectigo the default CA:

acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV

Issuing the certificate

Via webroot — the site directory your web server serves /.well-known/acme-challenge/ from:

acme.sh --issue --server https://acme.sectigo.com/v2/DV \
  -d example.kz -d www.example.kz -w /var/www/html

Other validation modes, used instead of -w /var/www/html:

• --nginx — acme.sh temporarily edits the nginx config for the validation;
• --apache — the same for Apache;
• --standalone — starts its own server on port 80 (stop the web server for the duration).

All domains in one command must be in the subscription and point to this server. Port 80 must be open.

Installing the certificate and reloading the web server

Do not reference files inside ~/.acme.sh/ directly — their layout may change. Copy the certificate to permanent paths and set a reload command; acme.sh remembers both and repeats them after every renewal:

mkdir -p /etc/ssl/example.kz
acme.sh --install-cert -d example.kz \
  --key-file       /etc/ssl/example.kz/privkey.pem \
  --fullchain-file /etc/ssl/example.kz/fullchain.pem \
  --reloadcmd      "systemctl reload nginx"

In the web server config:

# nginx
ssl_certificate     /etc/ssl/example.kz/fullchain.pem;
ssl_certificate_key /etc/ssl/example.kz/privkey.pem;

# Apache (reloadcmd: "systemctl reload apache2" or "httpd")
SSLCertificateFile    /etc/ssl/example.kz/fullchain.pem
SSLCertificateKeyFile /etc/ssl/example.kz/privkey.pem

Wildcard via DNS

For *.example.kz the CA validates the domain with a TXT record (dns-01), so acme.sh needs access to your DNS provider's API. Example for Cloudflare (acme.sh supports 150+ providers, listed on its dnsapi wiki page):

export CF_Token="token_with_zone_edit_permission"
export CF_Account_ID="account_id"
acme.sh --issue --server https://acme.sectigo.com/v2/DV --dns dns_cf \
  -d example.kz -d '*.example.kz'

The credentials are saved in ~/.acme.sh/account.conf, and renewals run without you. If the domain's DNS is hosted on our ns1/ns2.1host.kz, contact support — we will help set up DNS validation. We do not recommend manual mode (--dns without a provider, adding the TXT record by hand) for Auto SSL: the record would have to be changed on every renewal.

Verification and renewal

List certificates and their next renewal dates:

acme.sh --list

Check that the site serves a Sectigo certificate:

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates

The issuer should contain O = Sectigo Limited. Renewal is done by the daily cron job: the certificate is renewed about 30 days before expiry, then --reloadcmd runs. To force a renewal and test the whole chain:

acme.sh --renew -d example.kz --force

The log is in ~/.acme.sh/acme.sh.log. While the subscription is active (the renewal invoice arrives 14 days before the end of the year), nothing else is required. Questions — ONEHOST support via the client area, around the clock.