What You’ll Need<\/h2>\n
Before you begin, make sure you have the following:<\/p>\n
- \n
- SSH Access<\/strong> \u2013 Access to your cPanel account’s SSH terminal or a third-party SSH client.<\/li>\n
- ACME Server URL<\/strong> \u2013 The server URL provided by the Certificate Authority (e.g., https:\/\/acme.sectigo.com\/v2\/DV).<\/li>\n
- ACME Credentials<\/strong> \u2013 Your EAB Key ID (eab-kid) and EAB HMAC Key (eab-hmac-key) from your Certificate Authority.<\/li>\n
- Webroot Path<\/strong> \u2013 The directory path where your website files are stored (e.g., \/home\/yoursitename\/public_html\/).<\/li>\n<\/ul>\n
Step 1: Access the SSH Terminal<\/h2>\n
The quickest way to access SSH is through cPanel’s built-in terminal:<\/p>\n
- \n
- Log in to your cPanel account.<\/li>\n
- Scroll down to the Advanced<\/strong><\/li>\n
- Click Terminal<\/strong>.<\/li>\n
- If prompted, click I Understand<\/strong> to proceed.<\/li>\n<\/ol>\n
Tip: <\/strong>You can also connect using a third-party SSH client. Many web hosts use a non-standard SSH port (not 22), so check your host’s documentation for connection details.<\/p>\n
Step 2: Install the ACME.sh Client<\/h2>\n
ACME.sh is a lightweight ACME client that’s compatible with cPanel’s limited SSH environment. Run this command to install it:<\/p>\n
curl https:\/\/get.acme.sh | sh<\/code><\/p>\nThe installation will display output showing where ACME.sh has been installed. Take note of the installation path; you may need it in the next step.<\/p>\n
Step 3: Register with the ACME Server<\/h2>\n
Run the following command to register your account with the ACME server:<\/p>\n
~\/.acme.sh\/acme.sh<\/code>
\n--register-account \\<\/code>
\n--server SERVER \\<\/code>
\n--eab-kid EAB_KID \\<\/code>
\n--eab-hmac-key EAB_HMAC_KEY<\/code><\/p>\nReplace the placeholders with your own values:<\/p>\n
- \n
- SERVER<\/strong> \u2013 The ACME server URL provided by the CA (e.g., https:\/\/acme.sectigo.com\/v2\/DV).<\/li>\n
- EAB_KID<\/strong> \u2013 Your External Account Binding Key ID (the shorter string).<\/li>\n
- EAB_HMAC_KEY<\/strong> \u2013 Your EAB HMAC Key (the longer string).<\/li>\n<\/ul>\n
Note: <\/strong>If you receive a “command not found” error, replace ~\/.acme.sh\/acme.sh with the full installation path shown during Step 2 (e.g., \/home\/yoursitename\/.acme.sh\/acme.sh).<\/p>\n
Step 4: Issue and Deploy the SSL Certificate<\/h2>\n
4.1<\/strong>: Run this command to issue your SSL certificate and prepare it for deployment:<\/p>\n
~\/.acme.sh\/acme.sh --issue \\<\/code>
\n--webroot \/path\/to\/webroot \\<\/code>
\n--domain yourdomain.com \\<\/code>
\n--deploy-hook cpanel_uapi \\<\/code>
\n--server SERVER \\<\/code>
\n--eab-kid EAB_KID \\<\/code>
\n--eab-hmac-key EAB_HMAC_KEY<\/code><\/p>\nReplace the placeholder values:<\/p>\n
- \n
- SERVER<\/strong> \u2013 The ACME server URL provided by the CA.<\/li>\n
- EAB_KID<\/strong> \u2013 Your External Account Binding Key ID.<\/li>\n
- EAB_HMAC_KEY<\/strong> \u2013 Your EAB HMAC Key.<\/li>\n
- com<\/strong> \u2013 Your fully qualified domain name (e.g., mydomain.com). To secure both the www and non-www versions of your domain, include the –domain flag twice:<\/li>\n<\/ul>\n
--domain mydomain.com --domain www.mydomain.com<\/code><\/p>\n- \n
- \/path\/to\/webroot<\/strong> \u2013 The directory path where your website’s homepage is stored (e.g., \/home\/yoursitename\/public_html\/). You can determine this path by using the cPanel File Manager to navigate to the folder where your homepage is located.<\/li>\n<\/ul>\n
4.2: <\/strong>Once the command completes successfully, the SSL certificate will be issued and stored on your server. Next, run the following command to import the certificate into cPanel:<\/p>\n
~\/.acme.sh\/acme.sh --deploy \\<\/code>
\n--domain yourdomain.com \\<\/code>
\n--deploy-hook cpanel_uapi<\/code><\/p>\nStep 5: Verify the Installation<\/h2>\n
Your SSL certificate should now be visible in cPanel. To confirm:<\/p>\n
- \n
- Navigate to SSL\/TLS > Certificates<\/strong> to view the installed certificate.<\/li>\n
- Navigate to SSL\/TLS > Manage SSL Sites<\/strong> to verify the certificate is applied to your domain.<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/www.thesslstore.com\/knowledgebase\/wp-content\/uploads\/2026\/02\/cpanel-acme-install.png\")
<\/a><\/p>\nTo verify your certificate is working correctly, visit your website using https:\/\/yourdomain.com and check for the padlock icon in your browser’s address bar. You can also use our SSL Checker Tool<\/a> for a more thorough verification.<\/p>\n
Automatic Certificate Renewal<\/h2>\n
ACME.sh automatically renews your certificate approximately 30 days before expiration. To verify that automatic renewal is working correctly, you can force a test renewal with this command:<\/p>\n
~\/.acme.sh\/acme.sh --cron --force<\/code><\/p>\nAfter the command completes successfully, you can verify the certificate has been renewed by checking the Certificate ID has updated under SSL\/TLS > Manage SSL Sites<\/strong> in cPanel.<\/p>\n
- Navigate to SSL\/TLS > Manage SSL Sites<\/strong> to verify the certificate is applied to your domain.<\/li>\n<\/ul>\n
- Navigate to SSL\/TLS > Certificates<\/strong> to view the installed certificate.<\/li>\n
- EAB_KID<\/strong> \u2013 Your External Account Binding Key ID.<\/li>\n
- EAB_KID<\/strong> \u2013 Your External Account Binding Key ID (the shorter string).<\/li>\n
- Click Terminal<\/strong>.<\/li>\n
- ACME Server URL<\/strong> \u2013 The server URL provided by the Certificate Authority (e.g., https:\/\/acme.sectigo.com\/v2\/DV).<\/li>\n