Auto SSL with certbot (Linux, nginx and Apache)

Auto SSL is a subscription under which your server obtains and renews Sectigo DV certificates on its own over the ACME protocol. This article covers setup with certbot on Linux (Ubuntu, Debian, AlmaLinux) for nginx and Apache. If you prefer acme.sh, see the separate guide.

Where to get the keys

1. Log in to the client area at 1host.kz/bill and open the "Auto SSL (Sectigo ACME)" service. If you do not have a subscription yet, order it on the Auto SSL page.
2. Click "Configure Now". In the "Single Domains" field list your domains (example.kz and www.example.kz count as one domain). For *.example.kz use the "Wildcard Domains" field — it is a separate item.
3. In 5–30 seconds the service card shows four values: ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

In the commands below: Server URL is https://acme.sectigo.com/v2/DV (the same for all customers), YOUR_EAB_KID is the EAB MAC ID value, YOUR_EAB_HMAC_KEY is the EAB MAC key value. Treat the keys like a password and do not publish them. Certificates are issued only for domains added to the subscription.

What you need

• A server with root or sudo access.
• The domain's A record (and www) points to this server.
• Port 80 is reachable from the internet — the CA validates the domain over it (http-01).
• certbot 1.3 or newer: EAB support was added there. We tested with certbot 4.0.

Installing certbot

Ubuntu / Debian:

sudo apt update
sudo apt install certbot python3-certbot-nginx     # for nginx
sudo apt install certbot python3-certbot-apache    # for Apache

AlmaLinux / Rocky / CentOS Stream:

sudo dnf install epel-release
sudo dnf install certbot python3-certbot-nginx python3-certbot-apache

If the repository version is old, install the current one via snap: sudo snap install --classic certbot. Check the version with certbot --version.

Issuing the certificate

No separate account registration is needed: on the first run certbot creates the account from the EAB keys. The variant we verified uses webroot (the directory your web server serves /.well-known/acme-challenge/ from):

sudo mkdir -p /var/www/acme
sudo certbot certonly --webroot -w /var/www/acme -d example.kz -d www.example.kz \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY \
  --email [email protected] --agree-tos --no-eff-email

For webroot, the nginx config for port 80 must contain:

location /.well-known/acme-challenge/ {
    root /var/www/acme;
}

If you would rather let certbot edit the web server config and wire the certificate in, replace certonly --webroot -w /var/www/acme with a plugin:

# nginx
sudo certbot --nginx -d example.kz -d www.example.kz \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY \
  --email [email protected] --agree-tos --no-eff-email

# Apache
sudo certbot --apache -d example.kz -d www.example.kz \
  --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY \
  --email [email protected] --agree-tos --no-eff-email

Issuance takes about 20 seconds. The account is stored in /etc/letsencrypt/accounts/acme.sectigo.com/, so you do not need the EAB keys for later issuances and renewals — --server is enough. To put several subscription domains into one certificate, list them with -d; each must point to this server.

Certificate files and configuration

The files are in /etc/letsencrypt/live/example.kz/: fullchain.pem (certificate with chain) and privkey.pem (private key). If you used certonly, reference them in the config yourself:

# nginx
ssl_certificate     /etc/letsencrypt/live/example.kz/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.kz/privkey.pem;

# Apache
SSLCertificateFile    /etc/letsencrypt/live/example.kz/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/example.kz/privkey.pem

So the web server picks up the new certificate after each renewal, add a reload hook once (certbot stores it in the renewal config):

sudo certbot renew --deploy-hook "systemctl reload nginx"

The same files can be used by a mail server, a control panel or any other service — the server licence is unlimited.

Common errors

• Connection refused / timeout during validation — port 80 is blocked by a firewall or the domain does not point to the server. Check dig +short example.kz and curl -I http://example.kz/.well-known/acme-challenge/test.
• Authorization error or the CA rejects the order — the domain is not in the subscription. Add it in the client area ("Add domain"); buy more if needed ("Buy more domains").
• unrecognized arguments: --eab-kid — certbot is too old. Update via snap.
• Subscription inactive — new certificates are not issued until the renewal invoice is paid (it is issued 14 days before the end of the term). Certificates already issued keep working until they expire.

Verification and renewal

Make sure the site serves a Sectigo certificate and check its validity period:

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates
sudo certbot certificates

The issuer line should contain O = Sectigo Limited. Renewal is handled by certbot's standard timer: it runs twice a day and renews certificates with less than 30 days left. Check that the timer is active and a renewal completes without errors:

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

If cron is used instead of systemd, the job is in /etc/cron.d/certbot. Nothing else is required: while the subscription is active, certificates renew on their own. If something does not work, open a ticket with ONEHOST support from the client area — we help around the clock.