How to Auto-Renew SSL Certificates on cPanel with acme.sh

Let's Encrypt certificates expire every 90 days. Manual renewal is tedious and error-prone — missing a renewal means expired certificates, browser warnings, and potential site downtime. Automation eliminates human error entirely.

What You'll Need

• SSH access to your cPanel account (root privileges not required)
• acme.sh installed in your home directory
• A domain with a working webroot for HTTP validation

Step 1: Install acme.sh (If Not Already Installed)

Check if already installed:

ls -la ~/.acme.sh/acme.sh

If not present, install via:

curl https://get.acme.sh | sh -s email=your-email@example.com

This installs to ~/.acme.sh without requiring root access.

Step 2: Write the Issue + Deploy Script

The process involves two stages: issuing the certificate (via Let's Encrypt validation) and deploying it to cPanel using the cpanel_uapi hook.

Here's the complete script:

#!/bin/bash## renew_ssl_cpanel.sh# Issues/renews a Let's Encrypt cert via acme.sh and auto-installs it into cPanel# via the built-in cpanel_uapi deploy hook.## Run as the cPanel account user that owns the domain — no root needed.set -euo pipefail # ---- CONFIG: edit these for your domain ----DOMAIN="yourdomain.com"ALIAS="www.yourdomain.com"WEBROOT="/home/youruser/yourdomain.com"ACME_SH="$HOME/.acme.sh/acme.sh"LOGDIR="$HOME/logs"mkdir -p "$LOGDIR"LOGFILE="$LOGDIR/acme_cpanel_deploy.log" echo "===== $(date) : Starting cert issue/renew for $DOMAIN =====" >> "$LOGFILE" # 1. Issue (or renew) the certificateif "$ACME_SH" --issue -d "$DOMAIN" -d "$ALIAS" -w "$WEBROOT" --server letsencrypt >> "$LOGFILE" 2>&1; then    echo "Cert issued OK for $DOMAIN" >> "$LOGFILE"else    echo "Cert issuance FAILED for $DOMAIN - aborting deploy" >> "$LOGFILE"    exit 1fi # 2. Deploy into cPanel via UAPIif "$ACME_SH" --deploy -d "$DOMAIN" --deploy-hook cpanel_uapi >> "$LOGFILE" 2>&1; then    echo "Cert deployed OK into cPanel for $DOMAIN" >> "$LOGFILE"else    echo "Deploy FAILED for $DOMAIN" >> "$LOGFILE"    exit 1fi echo "===== $(date) : Done for $DOMAIN =====" >> "$LOGFILE"

Save as ~/scripts/renew_ssl.sh and make executable:

chmod +x ~/scripts/renew_ssl.sh

Important: the --force flag is omitted deliberately. Without it, acme.sh only reissues certificates nearing expiry — preventing unnecessary rate limit hits across multiple domains.

Step 3: Test It Manually First

Run the script manually and check the log:

~/scripts/renew_ssl.shtail -f ~/logs/acme_cpanel_deploy.log

For debugging, use:

bash -x ~/scripts/renew_ssl.sh

This reveals command-by-command execution, typically exposing webroot path issues or domain/account mismatches.

Step 4: Schedule It with Cron

Once tested successfully, add to crontab:

crontab -e

Insert:

15 3 * * 0 /home/youruser/scripts/renew_ssl.sh >> /home/youruser/logs/cron_run.log 2>&1

This runs weekly on Sundays at 3:15 AM. Since acme.sh auto-renews around day 60 of the 90-day cycle, weekly checks provide ample buffer with redundancy for transient failures.

How the Deploy Hook Actually Works

The cpanel_uapi deploy hook invokes cPanel's UAPI (SSL::install_ssl) directly. When run as the domain-owning cPanel user (not root), no additional permissions are required — cPanel inherently trusts the account to manage its own certificates.

Wrapping Up

With this setup, the entire SSL lifecycle runs unattended weekly. Certificates issue, validate, and install automatically. The only ongoing maintenance is occasional log review or implementing log rotation.

No more calendar reminders. No more manual WHM logins. Just a cert that renews itself, quietly, in the background.