Auto SSL in ISPmanager 6

The built-in ISPmanager 6 module issues free certificates only from Let's Encrypt. The ACME server address can be changed with the LetsencryptAcmeUrl parameter in /usr/local/mgr5/etc/ispmgr.conf, but the panel does not support the external account binding (EAB) keys that Sectigo requires. So the working scheme for Auto SSL is: acme.sh on the same server issues the certificate, and you add it to the panel as "Existing".

Where to get the keys

1. In the client area at 1host.kz/bill open the "Auto SSL (Sectigo ACME)" service (order it on the Auto SSL page).
2. Click "Configure Now", enter the domains in "Single Domains" (www and non-www count as one domain); wildcards go in "Wildcard Domains".
3. In 5–30 seconds the card shows ACME account ID, EAB MAC ID, EAB MAC key, Server URL.

Below: Server URL is https://acme.sectigo.com/v2/DV, YOUR_EAB_KID is the EAB MAC ID, YOUR_EAB_HMAC_KEY is the EAB MAC key.

What you need

• Root SSH access to the ISPmanager 6 server.
• The site already exists in the panel, the domain points to the server, port 80 is open.
• The panel user that owns the site (user1 in the examples) and the site's document root: in ISPmanager it is usually /var/www/user1/data/www/example.kz. Check the exact path in the panel: "Sites" → site → "Root directory".

Issuing the certificate with acme.sh

Install acme.sh as root and register the account (once):

curl https://get.acme.sh | sh -s [email protected]
source ~/.bashrc
acme.sh --register-account --server https://acme.sectigo.com/v2/DV \
  --eab-kid YOUR_EAB_KID --eab-hmac-key YOUR_EAB_HMAC_KEY
acme.sh --set-default-ca --server https://acme.sectigo.com/v2/DV

Issue the certificate via the site's document root:

acme.sh --issue -d example.kz -d www.example.kz \
  -w /var/www/user1/data/www/example.kz

The files appear in ~/.acme.sh/example.kz_ecc/ (ECC keys are the default): fullchain.cer, example.kz.key, ca.cer. More on issuance modes in Auto SSL with acme.sh.

Adding the certificate to the panel

1. In ISPmanager open "SSL certificates" → "Add a certificate" → type "Existing".
2. "Username" — the site owner (user1).
3. "SSL certificate" — the contents of example.kz.cer (the domain certificate only, PEM format).
4. "SSL certificate key" — the contents of example.kz.key.
5. "SSL certificate chain" — the contents of ca.cer.
6. Save. Then "Sites" → select the site → "Edit" → enable the secure connection, pick the certificate you added and, if needed, HTTP-to-HTTPS redirection.

Print a file for copying with cat ~/.acme.sh/example.kz_ecc/example.kz.cer, etc. The panel keeps its own copy in /var/www/httpd-cert/user1/.

Automatic update after renewal

acme.sh renews the certificate about 30 days before expiry, but the panel will not know — it has its own copy. To avoid copying files by hand every two months, tell acme.sh where to put the renewed certificate and how to reload the web server:

ls /var/www/httpd-cert/user1/          # find the files of the certificate you added
acme.sh --install-cert -d example.kz \
  --cert-file      /var/www/httpd-cert/user1/example.kz.crt \
  --key-file       /var/www/httpd-cert/user1/example.kz.key \
  --ca-file        /var/www/httpd-cert/user1/example.kz.crtca \
  --fullchain-file /var/www/httpd-cert/user1/example.kz.crt \
  --reloadcmd      "systemctl reload nginx; systemctl reload httpd || systemctl reload apache2"

TO VERIFY: the exact certificate file names in /var/www/httpd-cert/USERNAME/ (the panel names them NAME_NUMBER, e.g. example-crt_1) — use the ones you see in ls; the --fullchain-file path must match the file referenced by the site's nginx/Apache config.

The alternative without touching panel files is to paste the new contents into "SSL certificates" → certificate → "Edit" after each renewal. If in doubt, contact ONEHOST support: we will set up the automatic replacement for you.

Verification and renewal

Open the site over HTTPS and view the certificate in the browser: the issuer should be Sectigo. From the console:

echo | openssl s_client -connect example.kz:443 -servername example.kz 2>/dev/null \
  | openssl x509 -noout -issuer -dates
acme.sh --list

Renewal is done by the daily acme.sh cron job (crontab -l | grep acme.sh), followed by --reloadcmd. To test the whole chain: acme.sh --renew -d example.kz --force, then openssl again — the "notAfter" date should move. In the panel itself an "Existing" certificate is marked as not auto-renewed — that is expected, acme.sh handles renewal. The Auto SSL subscription is renewed by an invoice once a year; while it is active, issuance and renewal are unlimited.