LiteSpeed Setup

For OpenLiteSpeed or LiteSpeed Enterprise.

This guide uses acme.sh to issue the certificate and install it into the LiteSpeed configuration directory.

1. Set Variables

export DOMAIN="example.com"
export EMAIL="admin@example.com"
export WEBROOT="/usr/local/lsws/Example/html"
export ACME_SERVER="your Server URL"
export EAB_KID="your EAB MAC ID"
export EAB_HMAC_KEY="your EAB MAC key"
export CERT_DIR="/usr/local/lsws/conf/cert/$DOMAIN"

Make sure LiteSpeed has an HTTP listener on port 80 for ACME validation.

Single-domain certificates should include example.com and www.example.com.

2. Install acme.sh

curl https://get.acme.sh | sh
source ~/.bashrc 2>/dev/null || source ~/.zshrc 2>/dev/null || true
~/.acme.sh/acme.sh --version

3. Register the ACME Account

~/.acme.sh/acme.sh --register-account \
  --server "$ACME_SERVER" \
  --eab-kid "$EAB_KID" \
  --eab-hmac-key "$EAB_HMAC_KEY" \
  --accountemail "$EMAIL"

4. Issue the Certificate

Single domain, including the root domain and www:

~/.acme.sh/acme.sh --issue \
  -d "$DOMAIN" \
  -d "www.$DOMAIN" \
  -w "$WEBROOT" \
  --server "$ACME_SERVER"

Multi-domain:

~/.acme.sh/acme.sh --issue \
  -d example.com \
  -d www.example.com \
  -d example.net \
  -d shop.example.org \
  -w "$WEBROOT" \
  --server "$ACME_SERVER"

Wildcard, including the root domain and *.:

export CF_Token="Cloudflare API Token"
export CF_Account_ID="Cloudflare Account ID"

~/.acme.sh/acme.sh --issue \
  --dns dns_cf \
  -d "$DOMAIN" \
  -d "*.$DOMAIN" \
  --server "$ACME_SERVER"

WARNING

Wildcard certificates require DNS validation and cannot use webroot validation.

5. Install the Certificate

sudo mkdir -p "$CERT_DIR"

sudo ~/.acme.sh/acme.sh --install-cert -d "$DOMAIN" \
  --key-file "$CERT_DIR/$DOMAIN.key" \
  --fullchain-file "$CERT_DIR/$DOMAIN.crt" \
  --reloadcmd "systemctl reload lsws || systemctl restart lsws"

6. Enable in LiteSpeed

Open LiteSpeed WebAdmin:

Listeners -> SSL -> SSL Private Key & Certificate

Use:

Private Key File: /usr/local/lsws/conf/cert/example.com/example.com.key
Certificate File: /usr/local/lsws/conf/cert/example.com/example.com.crt

Save and run Graceful Restart.

7. Check

curl -I "https://$DOMAIN"
~/.acme.sh/acme.sh --cron --home ~/.acme.sh