Auto SSL in cPanel

Do not confuse two similar names. AutoSSL in cPanel is a built-in feature that issues free certificates from the Let's Encrypt or cPanel (Sectigo) providers; a custom ACME server with EAB keys cannot be added there. Auto SSL from ONEHOST is a per-domain subscription under which your own ACME client issues Sectigo certificates. On a cPanel server that client is acme.sh, and it installs the certificate into the account itself via the cPanel API.

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (order it on the Auto SSL page).
2. Click "Configure Now", enter the domains in "Single Domains" (www and non-www count as one domain), wildcards in "Wildcard Domains".
3. In 5–30 seconds the card shows ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

In the commands: Server URL is https://acme.sectigo.com/v2/DV, YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key.

What you need

• Shell access to the cPanel account (SSH or "Terminal" in cPanel), or root on a WHM server.
• The domain is added to the cPanel account and points to the server; port 80 is open.
• If AutoSSL is enabled for the domain, disable it for this domain (cPanel → "SSL/TLS Status" → "Exclude from AutoSSL"); otherwise cPanel may replace the Sectigo certificate with its own.

Installing acme.sh in the user account

It is best to install acme.sh as the cPanel user — then the deploy hook installs the certificate without extra privileges:

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc
acme.sh --register-account --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY
acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV

Registration is done once; the account with the keys is stored in ~/.acme.sh/.

Issuing and installing via cpanel_uapi

Issue via webroot — the site directory (~/public_html for the main domain, ~/public_html/subdomain or the path from "Domains" for addon domains):

acme.sh --issue -d example.kz -d www.example.kz -w ~/public_html

Install into the account with the standard acme.sh deploy hook for cPanel:

acme.sh --deploy -d example.kz --deploy-hook cpanel_uapi

The hook calls uapi SSL install_ssl and is remembered: after every automatic renewal the certificate is reinstalled. A limitation from the acme.sh documentation: on renewal the hook installs the certificate only for the first domain of the issue command, so issue a separate certificate for each domain (with its www). If acme.sh runs as root, set the user: export DEPLOY_CPANEL_USER=cpuser before --deploy.

The manual alternative without the hook is cPanel → "SSL/TLS" → "Manage SSL sites": pick the domain, paste "Certificate (CRT)" from ~/.acme.sh/example.kz_ecc/example.kz.cer, "Private Key (KEY)" from example.kz.key, "Certificate Authority Bundle (CABUNDLE)" from ca.cer, and click "Install Certificate". Or the same from the console:

uapi --user=cpuser SSL install_ssl domain=example.kz \
  cert="$(cat ~/.acme.sh/example.kz_ecc/example.kz.cer)" \
  key="$(cat ~/.acme.sh/example.kz_ecc/example.kz.key)" \
  cabundle="$(cat ~/.acme.sh/example.kz_ecc/ca.cer)"

Common errors

• Domain validation fails — www or the domain itself points to another server; check dig +short www.example.kz. For domains behind a proxy (Cloudflare) use --dns.
• The CA rejects the order — the domain is not in the Auto SSL subscription; add it in the client area ("Add domain").
• The certificate "rolled back" to cPanel/Let's Encrypt — the domain was not excluded from AutoSSL.
• No shell access — ask to enable it in WHM ("Manage Shell Access") or contact ONEHOST support and we will set it up.

Verification and renewal

cPanel → "SSL/TLS Status": the domain should have a Sectigo certificate with a fresh date. From the console:

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates
acme.sh --list
crontab -l | grep acme.sh

The acme.sh cron job renews the certificate about 30 days before expiry and runs the deploy hook. To test the whole chain: acme.sh --renew -d example.kz --force, then openssl again — the notAfter date should change. The Auto SSL subscription is renewed by an invoice once a year; the invoice is issued 14 days in advance. Help is available from ONEHOST support around the clock.