How to add Let's Encrypt SSL to OpenLiteSpeed

OpenLiteSpeed has no certbot plugin, so you issue the certificate with certbot's webroot method and then point OpenLiteSpeed at the files. It takes four parts: get the certificate, add an HTTPS listener on port 443, redirect plain HTTP, and make sure the server picks up renewed certificates. This guide covers all four for example.com.

Before you start

• OpenLiteSpeed serving your site over HTTP on port 80. See Add virtual hosts and domains in OpenLiteSpeed.
• The domain and www name pointing at your server's IP, for example 203.0.113.10.
• Ports 80 and 443 open in the firewall.
• The site's document root. This guide uses /var/www/example.com/html.

Step 1: Install certbot

On Ubuntu and Debian:

sudo apt update
sudo apt install certbot

On AlmaLinux and Rocky Linux, certbot comes from EPEL:

sudo dnf install epel-release
sudo dnf install certbot

Step 2: Issue the certificate with webroot

The webroot method places a small file under /.well-known/acme-challenge/ in your document root. Let's Encrypt fetches it over HTTP to prove you control the domain. OpenLiteSpeed keeps serving the site the whole time.

sudo certbot certonly --webroot -w /var/www/example.com/html -d example.com -d www.example.com

Enter an email address for expiry notices and accept the terms. On success, certbot prints the file paths:

Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem

Step 3: Add the SSL listener in WebAdmin

1. Log in to WebAdmin at https://203.0.113.10:7080.
2. Go to Listeners and click +.
3. Set:

• Listener Name: HTTPS
• IP Address: ANY IPv4
• Port: 443
• Secure: Yes

1. Save, then open the new listener and go to the SSL tab.
2. Edit SSL Private Key & Certificate:

• Private Key File: /etc/letsencrypt/live/example.com/privkey.pem
• Certificate File: /etc/letsencrypt/live/example.com/fullchain.pem
• Chained Certificate: Yes

1. Save. On the General tab of the listener, add a Virtual Host Mapping for example.com with the domains example.com, www.example.com.

More than one site on 443

The listener's certificate is the fallback. For each additional domain, open that virtual host, go to its SSL tab and set its own key and certificate paths. OpenLiteSpeed uses SNI to send the right certificate for each domain, as long as each vhost is mapped on the 443 listener.

Step 4: Redirect HTTP to HTTPS

Open the virtual host, go to the Rewrite tab, make sure Enable Rewrite is Yes, and add these lines to Rewrite Rules:

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Save, then click Graceful Restart. If you use WordPress, you can put the same rules at the top of .htaccess instead, but the vhost is the cleaner place.

Step 5: Restart OpenLiteSpeed after each renewal

Certbot installs a systemd timer that renews certificates before they expire. OpenLiteSpeed only reads certificate files when it starts, so it must restart after a renewal. Add a deploy hook, which certbot runs only when a certificate actually changes:

sudo tee /etc/letsencrypt/renewal-hooks/deploy/restart-lsws.sh > /dev/null <<'EOF'
#!/bin/sh
/usr/local/lsws/bin/lswsctrl restart
EOF
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/restart-lsws.sh

Test the renewal process without issuing a real certificate:

sudo certbot renew --dry-run

It should end with Congratulations, all simulated renewals succeeded. Confirm the timer is active with systemctl list-timers | grep certbot. If certbot was installed another way and has no timer, add a cron job that runs certbot renew twice a day.

Check it works

1. Open https://example.com and check the padlock in the browser.
2. Check the redirect:

   curl -I http://example.com/

You should see 301 and a location: https://example.com/ header.

1. Check the certificate dates and issuer:

   echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -dates

Troubleshooting

• Certbot fails with a 404 on the challenge URL: the -w path is not the document root of the vhost that answers the domain. Check the vhost's Document Root and the listener mapping on port 80.
• Browser shows the self-signed WebAdmin certificate or the wrong domain: the domain is not mapped on the 443 listener, or its vhost has no SSL entry. Add the mapping and restart.
• Redirect loop: a CDN such as Cloudflare connects to your server over HTTP while forcing HTTPS for visitors. Set Cloudflare SSL mode to Full (strict).
• Site still shows the old certificate after renewal: the deploy hook did not run or is not executable. Check its permissions and run lswsctrl restart by hand.

Next steps

• Learn how certificates are issued: How Let's Encrypt works.
• Fix renewal problems: Certbot renewal troubleshooting.
• Fix pages that show "not secure" after the switch: Fix mixed content warnings.