Auto SSL on BitrixVM

BitrixVM is CentOS or AlmaLinux with nginx in front of Apache and its own configuration menu. The standard menu item issues only Let's Encrypt certificates (via dehydrated), so for Auto SSL acme.sh obtains the Sectigo certificate and we wire it in through the BitrixVM menu "Configure own certificate" — that way the settings are not overwritten by environment updates.

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (order it on the Auto SSL page).
2. Click "Configure Now", enter the domains in "Single Domains" (www and non-www count as one domain), wildcards in "Wildcard Domains".
3. In 5–30 seconds the card shows ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

In the commands: Server URL is https://acme.sectigo.com/v2/DV, YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key.

BitrixVM specifics

• The default site root is /home/bitrix/www; additional sites live in /home/bitrix/ext_www/domain.
• Certificates are kept in /etc/nginx/certs/; the BitrixVM menu accepts your own files in PEM format.
• Port 80 must be open in firewalld: firewall-cmd --list-services should show http https.
• If you previously enabled Let's Encrypt from the menu, its dehydrated job keeps running and may overwrite the certificate — after switching to Sectigo remove the domain from it (see the errors section).

Installing acme.sh and registering

acme.sh works the same on CentOS 7 and AlmaLinux 9 and needs no packages, unlike certbot from EPEL. As root:

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc
acme.sh --register-account --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY
acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV

If you prefer certbot, install it (dnf install epel-release certbot) and use the command from Auto SSL with certbot with --webroot -w /home/bitrix/www.

Issuing and wiring in via the BitrixVM menu

Issue the certificate via the site root (BitrixVM's nginx serves static files from it directly, including /.well-known/acme-challenge/):

acme.sh --issue -d example.kz -d www.example.kz -w /home/bitrix/www

Put the files at permanent paths under /etc/nginx/certs/ and set an nginx reload after renewal:

mkdir -p /etc/nginx/certs/example.kz
acme.sh --install-cert -d example.kz \
  --key-file       /etc/nginx/certs/example.kz/privkey.pem \
  --fullchain-file /etc/nginx/certs/example.kz/fullchain.pem \
  --reloadcmd      "systemctl reload nginx"

Now wire them in through the BitrixVM menu: run /root/menu.sh → "9. Manage pool web servers" → "2. Configure certificates" → "2. Configure own certificate". Enter:

• Sitename — the site name in BitrixVM (default for the main site or the name of an additional site);
• Private Key path — /etc/nginx/certs/example.kz/privkey.pem;
• Certificate path — /etc/nginx/certs/example.kz/fullchain.pem;
• Certificate Chain path — may be left empty, the chain is already inside fullchain.pem.

The menu rewrites the nginx configs and restarts it. The paths that were applied are shown in the same menu section.

TO VERIFY: whether the "Configure own certificate" menu copies the files into its own directory or references the given paths — after setup compare the paths shown in the menu with those above; if they differ, use the paths the menu shows in --install-cert (editing /etc/nginx/bx/conf/ssl.conf by hand is not recommended — the file belongs to the BitrixVM environment).

Several sites on one machine

Each additional site gets its own issuance with its webroot (-w /home/bitrix/ext_www/shop.example.kz), its own directory under /etc/nginx/certs/ and its own site name in the menu. All domains must be in the Auto SSL subscription (subdomains such as shop.example.kz are separate domains).

Common errors

• Validation fails (timeout) — port 80 is closed: firewall-cmd --permanent --add-service=http && firewall-cmd --reload; or the domain does not point to the machine.
• The certificate switched back to Let's Encrypt — the standard dehydrated job from the BitrixVM menu is running (Saturdays at 2:00). Remove the domain from its configuration or switch the site to your certificate again via the menu; if in doubt, contact support.
• The CA rejects the order — the domain is not in the subscription; add it in the client area.
• After a BitrixVM update the site serves a different certificate — repeat "Configure own certificate" with the same paths.

Verification and renewal

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates
acme.sh --list
crontab -l | grep acme.sh

The issuer is Sectigo Limited; the cron line means renewal is enabled. acme.sh renews the certificate about 30 days before expiry and runs systemctl reload nginx. To test the whole chain: acme.sh --renew -d example.kz --force, then openssl again — the notAfter date should move. The Auto SSL subscription is renewed by an invoice once a year (issued 14 days in advance). Questions — ONEHOST support via the client area, around the clock.