• The cPanel specific defaults are:
  • Only looks in a single apache config file, which includes all VirtualHost configurations
  • Using a cPanel script called “whmapi1” to install the certificates
• UTF-8 is assumed for all strings (this is generally the default anyways)

Examples

Basic Example

On a cPanel system, this will add SSL certificates for all domains on the same IP as example.com, with each DocRoot/VHost having a different certificate

Main.php -dexample.com -eyour@email.com

Remote Example

php Main.php -dexample.com -eyour@email.com \
  -a 'ssh2.sftp://USER:PASSWORD@example.com//etc/httpd/conf/httpd.conf' \
  -c '/^(.*)$/ssh2.sftp:\/\/USER:PASSWORD@example.com\/$1/D' \
  -s 'ssh USER:PASSWORD@example.com "whmapi1 installssl domain=%s crt=%s key=%s cab=%s"' \
  -l 'ssh USER:PASSWORD@example.com "letsencrypt ?Params?"'

Other Notes

I actually had this pretty much complete a month ago, when letsencrypt first came out. I am very annoyed at myself for waiting so long to get it released.

While there are currently a lot of other solutions out there for this, I feel mine is a good generic solution that can fit any situation with all the options. That being said, sorry for including so many parameters! I'm kind of GNUish that way.

All of the defaults can also be modified in the Config.php file.

Requirements

1. letsencrypt must already be installed. If it is not part of the path, make sure to pass the “LECmd” parameter
2. If using cPanel scripts, cPanel must already be installed on the system
3. By default, domain VirtualHosts can only be located in a single apache configuration file. This is easily fixable with an example below for the “ApacheConfPath” parameter

This works by

1. Finds the IP of a given domain in the apache conf file(s)
2. Finds all VirtualHosts bound to that IP in the apache conf(s) and extracts all of their ServerName and ServerAlias domains
3. Runs all these found domains through letsencrypt to create a master certificate for the IP
4. Installs the certificate for each VirtualHost on the IP

Parameters

***IMPORTANT PARAMETER WARNING***

• Any parameter marked as “UnsafeVar” will only be usable if the “AllowConfigOverride” PHP configuration variable is set as true/On. It is currently set as “On”
  • If the user is not completely trusted, this needs to be set to false; as otherwise, they can read any file or run any system command as the current user

Other parameter info

• Any parameter marked as “File” uses file_get_contents(), so it can contain PHP fopen wrappers available on your system like SSH (https://secure.php.net/manual/en/wrappers.php)
  • Example (remote file via SSH): ssh2.sftp://user:pass@example.com:22/etc/httpd.conf
  • Example (multiple remote apache config files via SSH): ssh2.exec://user:pass@example.com/find /etc/httpd/conf* -type f -print0 | xargs -0 cat
    • Warning: ssh2.exec is currently broken on the php.ssh2 library (v<=0.12), but I have submitted a patch for it
• Any parameter marked as “Exec” will be run with exactly what is given through the command line via php.exec()
  • Paths and parameters that you give are NOT ESCAPED, so you must do so yourself
  • This generally just entails putting quotes around any path or parameter that includes a space
  • Example: ls -l 'my file.conf'
• For “BOOL” parameters, only the first case-insensitive character is looked at, and only the following characters evaluate to true: 1, y, t

Parameters