Auto SSL in FastPanel

FastPanel can issue free certificates only from Let's Encrypt; there is no way to set a custom ACME server and EAB keys in its interface. For Auto SSL we use acme.sh on the same server: it obtains the Sectigo certificate, and you add it to the panel the standard way as an existing certificate. The general panel guide is How to install an SSL certificate in FastPanel.

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (order it on the Auto SSL page).
2. Click "Configure Now". Domains go in "Single Domains" (www and non-www count as one domain), wildcards in "Wildcard Domains".
3. In 5–30 seconds the card shows ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

In the commands: Server URL is https://acme.sectigo.com/v2/DV, YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key.

What you need

• Root SSH access to the FastPanel server.
• The site exists in the panel, the domain points to the server, port 80 is open.
• The site's document root — see the site card in the panel (usually /var/www/user/data/www/example.kz).

Issuing the certificate with acme.sh

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc
acme.sh --register-account --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY
acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV
acme.sh --issue -d example.kz -d www.example.kz \
  -w /var/www/fastuser/data/www/example.kz

Replace fastuser with the site owner. Account registration is needed once; the keys are remembered. The result is in ~/.acme.sh/example.kz_ecc/: example.kz.cer (certificate), example.kz.key (key), ca.cer (chain). Other modes (--nginx, --standalone) are described in Auto SSL with acme.sh.

Installing the certificate in the panel

1. Open the site card → "SSL certificates" → "New certificate".
2. On the left choose "Existing".
3. "Private key" — the contents of example.kz.key.
4. "Certificate" — the contents of example.kz.cer.
5. "Chain" — the contents of ca.cer.
6. Click "Save" — the panel applies the certificate to the site.
7. Enable the redirect: site card → "Options" → "HTTPS" → "Redirect to HTTPS".

Print a file for copying: cat ~/.acme.sh/example.kz_ecc/example.kz.cer.

Update after renewal

acme.sh renews the certificate via cron about 30 days before expiry, but FastPanel keeps its own copy and will not notice. Options:

• Manually — repeat the steps from the previous section every two months (the panel shows the expiry date in the certificate list; set a reminder).
• Automatically — replace the files the panel put into the site's nginx config with acme.sh --install-cert … --reloadcmd "systemctl reload nginx". Find the paths in the site config: grep -r ssl_certificate /etc/nginx/fastpanel2-sites/. Note that the panel may overwrite them when site settings change.

TO VERIFY: the directory where FastPanel stores uploaded certificates, and whether replaced files survive re-saving the site in the panel — check on the current version before enabling automatic replacement.

If you would rather not dig into it, open a ticket with ONEHOST support from the client area and we will set up automatic updates.

Verification and renewal

Open the site over HTTPS and view the certificate in the browser — the issuer is Sectigo. From the console:

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates
acme.sh --list
crontab -l | grep acme.sh

The cron line means renewal is enabled. Force a renewal to test: acme.sh --renew -d example.kz --force. After a renewal update the certificate in the panel (or confirm the automatic replacement worked — the notAfter date in the openssl output should move). The Auto SSL subscription is renewed by an invoice once a year; the invoice arrives 14 days in advance.