# Hosting with cPanel — the certificate renews by itself

> A cron job in cPanel fetches the fresh certificate once a day and installs it on your site with cPanel's built-in tool. No SSH needed.

URL: https://zrazu.com/en/docs/ssl-auto-cpanel/

Use this for hosting with a cPanel panel: Hostiq, Hostpro, Ukrnames, GoDaddy, Namecheap, some NIC.UA plans and many others. A sign of cPanel: the panel has "Files", "Security" and "Advanced" sections, and the login address often ends in `:2083`. You do not need SSH; everything is done with the mouse in the panel.

Your private key is stored in cPanel itself and never gets into the script: cPanel picks the key the certificate was first installed with for the new certificate on its own.

## What you need

- The certificate link from your account: `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN`.
- In cPanel, the **Cron Jobs** item in the "Advanced" section. If it is missing, your plan does not allow scheduled tasks: write to your host or switch to [manual renewal](https://zrazu.com/en/docs/ssl-auto-panels-manual.md).
- 10 minutes.

## Step 1. First installation (if the certificate is not installed yet)

1. Open **Security → SSL/TLS → Manage SSL sites**.
2. In the **Domain** field choose example.com.
3. **Certificate (CRT)** — paste the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem` (open the link in a browser and copy all the text).
4. **Private Key (KEY)** — your private key. If the CSR was created in this cPanel, the key fills in by itself after you paste the certificate.
5. **Certificate Authority Bundle (CABUNDLE)** — the contents of `https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem`.
6. Click **Install Certificate**.

After this, the key is saved in cPanel, and the certificate will be renewed without it from now on.

## Step 2. The renewal script

1. Open **Files → File Manager**. You are in your home folder (`/home/…` is selected at the top left). Do **not** go into `public_html` — the script must not be reachable from the website.
2. **+ Folder** → name `zrazu-ssl` → **Create New Folder**. Go into it.
3. **+ File** → name `update.sh` → **Create New File**. Select the file → **Edit**, paste the text below and click **Save Changes**.

```sh file=zrazu-cpanel-update.sh
#!/bin/sh
# ZRAZU: updates SSL in cPanel using the personal link. Run by cron once a day.
set -eu
PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN"
DOMAIN="example.com"
UAPI=/usr/local/cpanel/bin/uapi
cd "$HOME/zrazu-ssl"

curl -fsS --retry 3 --max-time 60 -o cert.new "$PULL/cert.pem"
curl -fsS --retry 3 --max-time 60 -o chain.new "$PULL/chain.pem"
grep -q "BEGIN CERTIFICATE" cert.new || { echo "ZRAZU: the link does not return a certificate"; exit 1; }
if [ -f cert.applied ] && cmp -s cert.new cert.applied; then
  echo "ZRAZU: certificate unchanged"
  rm -f cert.new chain.new
  exit 0
fi
enc() { perl -0777 -pe 's/([^A-Za-z0-9_.~-])/sprintf("%%%02X", ord($1))/seg' "$1"; }
out=$("$UAPI" --output=json SSL install_ssl domain="$DOMAIN" cert="$(enc cert.new)" cabundle="$(enc chain.new)")
if printf '%s' "$out" | grep -Eq '"status" *: *1'; then
  mv -f cert.new cert.applied
  rm -f chain.new
  echo "ZRAZU: new certificate installed"
else
  echo "ZRAZU: cPanel did not install the certificate, response:"
  printf '%s\n' "$out"
  exit 1
fi
```

4. Select `update.sh` → **Permissions** → set `700` → **Change Permissions**.

## Step 3. Schedule

1. Open **Advanced → Cron Jobs**.
2. You can enter your own email in **Cron Email** — then every error will be emailed to you.
3. In **Add New Cron Job** → **Common Settings** choose **Once Per Minute** (this is only for the first check; we change it in step 4).
4. **Command**:

```sh
/bin/sh $HOME/zrazu-ssl/update.sh >> $HOME/zrazu-ssl/log.txt 2>&1
```

5. **Add New Cron Job**.

## Step 4. Check

1. Wait 2 minutes and open `zrazu-ssl/log.txt` in File Manager. It should say "new certificate installed", and after that "certificate unchanged".
2. Go back to **Cron Jobs**, click **Edit** on the task in the list and change **Common Settings** to **Once Per Day**. Save.
3. Check the site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) — it should show the ZRAZU certificate and its expiry date.

## So your host does not replace our certificate

Many cPanel hosts install a free certificate themselves (AutoSSL). By default it does not touch ours, but if your host allowed it, open **Security → SSL/TLS Status**, tick example.com and `www.example.com` and click **Exclude Domains from AutoSSL**.

## If it did not work

- The log says `uapi: not found` or `Permission denied` — the host has closed the cPanel tool to scripts. Then create a token in **Security → Manage API Tokens** and in the script replace the `out=$(…)` line with this one (LOGIN is your cPanel login name, SERVER is the address you use to open cPanel, without `:2083`):

```sh
out=$(curl -fsS -H "Authorization: cpanel LOGIN:TOKEN" "https://SERVER:2083/execute/SSL/install_ssl" --data-urlencode "domain=$DOMAIN" --data-urlencode "cert@cert.new" --data-urlencode "cabundle@chain.new")
```

- "cPanel did not install the certificate" and the response mentions the key (`private key`) — cPanel has no key for this certificate. Repeat step 1 with your key.
- `curl: (22) … 404` — the link is disabled or replaced: create a new one in the certificate card and replace the `PULL` line.