Let’s Encrypt on Ubuntu with OpenLiteSpeed: Auto-Renewal

Introduction to Let’s Encrypt

Let’s Encrypt is an automated, open, and free certificate authority (CA) operated by the Internet Security Research Group (ISRG). Let’s Encrypt certificates currently have a default validity period of 90 days, so servers should be configured for automatic renewal rather than waiting for a certificate to expire (according to letsencrypt.org).

This article explains how to install a Let’s Encrypt TLS/SSL certificate on an Ubuntu server running OpenLiteSpeed with Certbot. You will obtain the certificate using the webroot, configure OpenLiteSpeed to use the certificate files, set up an HTTP-to-HTTPS redirect, and test automatic renewal.

Prerequisites

A supported Ubuntu server and an account with sudo.
OpenLiteSpeed installed and serving a website.
The domain and any subdomains for which you need certificates, such as example.com and www.example.com, pointing to the correct server IP address.
TCP ports 80 and 443 must be open in the firewall or your VPS provider’s security group. Let’s Encrypt must be able to reach the server to verify control of the domain.
The exact document root of the website, for example /var/www/html/example.com.

OpenLiteSpeed also now includes built-in ACME support for issuing and renewing certificates automatically. However, if you manage certificates with Certbot or want to retain your current workflow, Certbot can still be used independently (according to the OpenLiteSpeed ACME documentation).

Install Certbot on Ubuntu

Certbot recommends installing the software through Snap. If Certbot was previously installed from apt or a certbot-autopackage, remove the older version to avoid invoking the wrong program during renewal (according to the Certbot installation instructions).

sudo apt-get remove certbot
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

If the server does not have snapd, install and enable Snap by following the instructions for the Ubuntu version in use before running the commands above.

Obtain a Certificate Using the Webroot Method

With OpenLiteSpeed running on port 80, the webroot method is usually more suitable standalone because it does not require stopping the web server. Certbot creates a challenge file in the .well-known/acme-challengedirectory; Let’s Encrypt accesses this file over HTTP to verify the domain.

sudo certbot certonly --webroot 
  -w /var/www/html/example.com 
  -d example.com 
  -d www.example.com

Replace example.com and the -w path with your actual values. If the website has multiple domains that use different document roots, specify the -w option before each corresponding group of domains.

Do not block or incorrectly redirect the /.well-known/acme-challenge/path. Check the document root permissions and ensure that OpenLiteSpeed can serve files from this directory over port 80.
Important note

If port 80 cannot serve the website, you can use the standalonemethod, but you must stop OpenLiteSpeed first so that Certbot can temporarily use the port:

sudo systemctl stop lsws
sudo certbot certonly --standalone -d example.com -d www.example.com
sudo systemctl start lsws

Configure the Certificate in OpenLiteSpeed

After successful issuance, Certbot typically stores the certificate in the /etc/letsencrypt/live/example.com/directory. In the OpenLiteSpeed WebAdmin Console, go to Listeners > HTTPS > SSL or the virtual host’s SSL section, and set the following:

Private Key File: /etc/letsencrypt/live/example.com/privkey.pem
Certificate File: /etc/letsencrypt/live/example.com/fullchain.pem
Chained Certificate: Yes

Ensure that the HTTPS listener is listening on port 443 and that the virtual host is mapped to the correct domain name. OpenLiteSpeed supports certificate configuration at either the listener or virtual-host level; virtual-host configuration takes precedence (according to the OpenLiteSpeed SSL documentation).

Save the configuration, then restart OpenLiteSpeed:

sudo systemctl restart lsws

Redirect HTTP to HTTPS

The certbot certonly command only obtains the certificate; it does not modify the OpenLiteSpeed configuration or enable an HTTP-to-HTTPS redirect automatically. You must configure the redirect at the virtual-host level or in the rewrite file loaded by OpenLiteSpeed.

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

To preserve the domain name originally requested by the user, you can use the appropriate server variable in your configuration instead of hard-coding example.com. After changing a rewrite rule, restart or gracefully restart OpenLiteSpeed to apply the configuration (according to the OpenLiteSpeed rewrite rule documentation).

Checking automatic Let’s Encrypt renewal

Certbot installed via Snap includes an automatic mechanism for checking and renewing certificates. The command renew handles certificates that are nearing expiration and can run periodically without forcing a renewal every time.

sudo certbot renew --dry-run

If the test command succeeds, check Certbot’s timer:

systemctl list-timers --all | grep -i certbot
sudo snap services certbot

Certbot typically uses a systemd timer or the scheduling mechanism provided by its package. You should not edit files directly in /etc/letsencrypt/renewal/ unless you have backed them up and verified the configuration with --dry-run.

Reloading OpenLiteSpeed after renewal

OpenLiteSpeed points to fixed paths in the directory /etc/letsencrypt/live/. After Certbot issues a new certificate, the server typically needs to be reloaded to use it. You can create a deploy hook that runs only after a successful renewal:

sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-openlitespeed.sh > /dev/null <<'EOF'
#!/bin/sh
systemctl reload lsws
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-openlitespeed.sh

If the system does not support reload for your service, use the restart command documented by OpenLiteSpeed:

sudo systemctl restart lsws

The deploy hook runs only after the certificate has actually been renewed. You can test the hook with certbot renew --dry-run; when you need to test the hook separately on a Certbot version that supports this option, add --run-deploy-hooks (see the Certbot User Guide).

Verifying that HTTPS is working

Check the website in a browser at https://example.com/. You should also verify the subdomain, redirect status, and certificate expiration date:

curl -I http://example.com
curl -I https://example.com
sudo certbot certificates

The expected result is that HTTP requests are redirected to HTTPS, while HTTPS requests return a normal response with a certificate matching the domain name. If the browser displays a certificate warning, recheck the paths fullchain.pem, privkey.pem, the virtual-host mapping, and when OpenLiteSpeed was last reloaded.

You have completed the installation of a Let’s Encrypt certificate on Ubuntu with OpenLiteSpeed and configured an automatic renewal process.

Install Let’s Encrypt on Ubuntu with OpenLiteSpeed