SSL: automatic renewal

Hosting with cPanel — the certificate renews by itself

A cron job in cPanel fetches the fresh certificate once a day and installs it on your site with cPanel's built-in tool. No SSH needed.

Renews by itself

Use this for hosting with a cPanel panel: Hostiq, Hostpro, Ukrnames, GoDaddy, Namecheap, some NIC.UA plans and many others. A sign of cPanel: the panel has "Files", "Security" and "Advanced" sections, and the login address often ends in :2083. You do not need SSH; everything is done with the mouse in the panel.

Your private key is stored in cPanel itself and never gets into the script: cPanel picks the key the certificate was first installed with for the new certificate on its own.

What you need

  • The certificate link from your account: https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN.
  • In cPanel, the Cron Jobs item in the "Advanced" section. If it is missing, your plan does not allow scheduled tasks: write to your host or switch to manual renewal.
  • 10 minutes.

Step 1. First installation (if the certificate is not installed yet)

  1. Open Security → SSL/TLS → Manage SSL sites.
  2. In the Domain field choose example.com.
  3. Certificate (CRT) — paste the contents of https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/cert.pem (open the link in a browser and copy all the text).
  4. Private Key (KEY) — your private key. If the CSR was created in this cPanel, the key fills in by itself after you paste the certificate.
  5. Certificate Authority Bundle (CABUNDLE) — the contents of https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN/chain.pem.
  6. Click Install Certificate.

After this, the key is saved in cPanel, and the certificate will be renewed without it from now on.

Step 2. The renewal script

  1. Open Files → File Manager. You are in your home folder (/home/… is selected at the top left). Do not go into public_html — the script must not be reachable from the website.
  2. + Folder → name zrazu-ssl → Create New Folder. Go into it.
  3. + File → name update.sh → Create New File. Select the file → Edit, paste the text below and click Save Changes.
#!/bin/sh
# ZRAZU: updates SSL in cPanel using the personal link. Run by cron once a day.
set -eu
PULL="https://api.zrazu.com/ssl-pull/zsp_YOUR_TOKEN"
DOMAIN="example.com"
UAPI=/usr/local/cpanel/bin/uapi
cd "$HOME/zrazu-ssl"

curl -fsS --retry 3 --max-time 60 -o cert.new "$PULL/cert.pem"
curl -fsS --retry 3 --max-time 60 -o chain.new "$PULL/chain.pem"
grep -q "BEGIN CERTIFICATE" cert.new || { echo "ZRAZU: the link does not return a certificate"; exit 1; }
if [ -f cert.applied ] && cmp -s cert.new cert.applied; then
  echo "ZRAZU: certificate unchanged"
  rm -f cert.new chain.new
  exit 0
fi
enc() { perl -0777 -pe 's/([^A-Za-z0-9_.~-])/sprintf("%%%02X", ord($1))/seg' "$1"; }
out=$("$UAPI" --output=json SSL install_ssl domain="$DOMAIN" cert="$(enc cert.new)" cabundle="$(enc chain.new)")
if printf '%s' "$out" | grep -Eq '"status" *: *1'; then
  mv -f cert.new cert.applied
  rm -f chain.new
  echo "ZRAZU: new certificate installed"
else
  echo "ZRAZU: cPanel did not install the certificate, response:"
  printf '%s\n' "$out"
  exit 1
fi
  1. Select update.sh → Permissions → set 700 → Change Permissions.

Step 3. Schedule

  1. Open Advanced → Cron Jobs.
  2. You can enter your own email in Cron Email — then every error will be emailed to you.
  3. In Add New Cron Job → Common Settings choose Once Per Minute (this is only for the first check; we change it in step 4).
  4. Command:
/bin/sh $HOME/zrazu-ssl/update.sh >> $HOME/zrazu-ssl/log.txt 2>&1
  1. Add New Cron Job.

Step 4. Check

  1. Wait 2 minutes and open zrazu-ssl/log.txt in File Manager. It should say "new certificate installed", and after that "certificate unchanged".
  2. Go back to Cron Jobs, click Edit on the task in the list and change Common Settings to Once Per Day. Save.
  3. Check the site: https://zrazu.com/tools/ssl/example.com/ — it should show the ZRAZU certificate and its expiry date.

So your host does not replace our certificate

Many cPanel hosts install a free certificate themselves (AutoSSL). By default it does not touch ours, but if your host allowed it, open Security → SSL/TLS Status, tick example.com and www.example.com and click Exclude Domains from AutoSSL.

If it did not work

  • The log says uapi: not found or Permission denied — the host has closed the cPanel tool to scripts. Then create a token in Security → Manage API Tokens and in the script replace the out=$(…) line with this one (LOGIN is your cPanel login name, SERVER is the address you use to open cPanel, without :2083):
out=$(curl -fsS -H "Authorization: cpanel LOGIN:TOKEN" "https://SERVER:2083/execute/SSL/install_ssl" --data-urlencode "domain=$DOMAIN" --data-urlencode "cert@cert.new" --data-urlencode "cabundle@chain.new")
  • "cPanel did not install the certificate" and the response mentions the key (private key) — cPanel has no key for this certificate. Repeat step 1 with your key.
  • curl: (22) … 404 — the link is disabled or replaced: create a new one in the certificate card and replace the PULL line.

This page in Markdown