Skip to main content

How do I install my Premium SSL certificate on my own server (ACME)?

Install and auto-renew a WHC Premium SSL certificate on a server you manage yourself, using ACME credentials from your Client Area and the acme.sh client.

Your Premium SSL certificate can be installed and renewed automatically on a server you manage yourself, using an ACME client. ACME (Automatic Certificate Management Environment) is the standard protocol a client uses to request, install and renew certificates without manual steps each cycle. You generate credentials once in your Client Area, add them to the ACME client on your server, and the certificate issues and renews on its own for as long as your subscription is active.

Use this method if your website runs on your own server or with another hosting company. If your website is hosted with WHC, use the Automatic or Manual tab instead — there is nothing to install or run on a server.

This guide uses acme.sh, a lightweight ACME client that runs on most Linux servers and on cPanel accounts.

This method validates your domain over HTTP, which means the certificate can only cover domain names that point to your server. A certificate covering *.yourdomain.com cannot be issued this way.

Before you begin

You need:

  • A server you control, with terminal or SSH access, and the ability to run commands as root. The final step reloads your web server, which requires root.

  • acme.sh installed on that server. If you don't have it yet, install it from the acme.sh installation instructions on GitHub.

  • Your domain names already pointing to that server, with the server reachable from the internet on port 80.

  • The path to your website's web root — the folder your web server publishes for those domain names.

Validation works by placing a temporary file under /.well-known/acme-challenge/ in your web root and fetching it over HTTP. If port 80 is closed, or a redirect rule, firewall or security plugin intercepts that path, the certificate cannot be issued. If your certificate covers more than one domain name, the web root you use must serve all of them.

Generate your credentials in the Client Area

Your ACME credentials are three values that identify your server to WHC's certificate service. Generate them once, then keep them for as long as you use this certificate.

  1. Log in to your Client Area.

  2. Go to SSL and open your Premium SSL certificate.

  3. On Generate Certificate, select the External server tab.

  4. Under This certificate covers, check the domain names listed. Your credentials only work for these domain names — a request for any other name will fail.

  5. Click Generate Credentials.

The Client Area then shows three values, along with a ready-to-run setup command:

  • Key identifier (KID)

  • HMAC key

  • ACME directory URL

These three values stay visible in your Client Area, so you can copy them again later. Treat the HMAC key like a password and don't share it.

Set up acme.sh on your server

Run the three commands below on your server, in order. The first registers your server with WHC and only needs to run once. The second issues the certificate. The third installs it into your web server.

Three values come straight from the Client Area and must not be edited: the ACME directory URL, the KID, and the HMAC key. Three values you change for your own setup: your domain names, your web root path, and your web server reload command.

1. Register your server with WHC

acme.sh --register-account \
  --server "YOUR_ACME_DIRECTORY_URL" \
  --eab-kid "YOUR_KID" \
  --eab-hmac-key "YOUR_HMAC_KEY"

2. Issue the certificate

Repeat -d for each domain name the certificate covers. Set -w to your web root path.

acme.sh --issue \
  --server "YOUR_ACME_DIRECTORY_URL" \
  -d yourdomain.com -d www.yourdomain.com \
  -w /path/to/your/webroot

3. Install the certificate into your web server

The --reloadcmd value below is for nginx. If you run Apache, use systemctl reload apache2 instead.

acme.sh --install-cert -d yourdomain.com \
  --key-file /path/to/private.key \
  --fullchain-file /path/to/fullchain.cer \
  --reloadcmd "systemctl reload nginx"

acme.sh runs the reload command again on every renewal, so your web server picks up each new certificate without you doing anything.

Check that the certificate is live

  1. On your server, run acme.sh --list. Your domain name appears with its expiry date.

  2. In a browser, visit https://yourdomain.com. A padlock in the address bar means the certificate is installed and trusted.

Make sure automatic renewal is scheduled

acme.sh renews the certificate on its own using a scheduled task (cron job), which it adds when acme.sh itself is installed. Depending on how acme.sh was installed on your server, that task may be missing — and without it, nothing renews.

Confirm the task exists:

crontab -l | grep acme

If a line comes back mentioning acme.sh, renewal is scheduled and no further action is needed. If nothing comes back, add the task:

acme.sh --install-cronjob

Renewal continues automatically for as long as your Premium SSL subscription is active. If the subscription lapses, renewal stops and your certificate expires on its normal expiry date, after which visitors see a security warning.

If you need to replace your credentials

Regenerating your credentials invalidates the old KID and HMAC key immediately. Every server still using the old pair stops renewing until you install the new ones.

If your KID or HMAC key is lost, or you need to replace them, click Regenerate Credentials in your Client Area. This issues a new KID and HMAC key.

After regenerating, run the registration command again on every server that uses this certificate, with the new values.

Did this answer your question?