How to Install a Free SSL Certificate on Namecheap Shared Hosting Using acme.sh

Buying a domain from Namecheap automatically gives you access to basic SSL options. However, on shared hosting, if you want a free Let's Encrypt SSL certificate instead of paying extra, you can use acme.sh, a powerful, lightweight Automatic Certificate Management Environment (ACME) protocol client written in pure Bash.

acme.sh allows you to automatically get SSL certificates from Let's Encrypt, ZeroSSL, and others without needing heavy tools like Certbot. Unlike Certbot, acme.sh works beautifully even on servers where you don't have full control. In this article, I'll walk you through how to issue a free SSL certificate using acme.sh and how to install it manually on Namecheap's cPanel hosting, even if you don't have root server access.

Step 1: Install acme.sh

First, SSH into your server (or local machine) and install acme.sh:

curl https://get.acme.sh | sh
source ~/.bashrc

This installs acme.sh in your home directory under ~/.acme.sh.

Verify it’s installed correctly:

acme.sh --version

Step 2: Enable API Access on Namecheap

To let acme.sh create DNS records automatically for domain validation, you need to enable API access on Namecheap.

Here’s how:

1. Log into your Namecheap dashboard.
2. Go to Profile → Tools → API Access.
3. Click Enable API Access.
4. Copy your API Key (keep it private).
5. Find your server’s public IP address:

curl ifconfig.me

6. Add your server IP to Namecheap’s API Whitelist.

Without this, Namecheap will block any DNS API requests.

Step 3: Set Namecheap Credentials in Environment Variables

Once your API access is ready, tell acme.sh who you are by exporting your credentials:

export NAMECHEAP_USERNAME="your_namecheap_username"
export NAMECHEAP_API_KEY="your_namecheap_api_key"
export NAMECHEAP_SOURCEIP="your_server_public_ip"

This allows acme.sh to create the DNS validation records automatically. You can also add these lines to your ~/.bashrc file to make them permanent for future sessions.

Step 4: Issue the SSL Certificate

Now you're ready to issue your SSL certificate. In your terminal, run:

acme.sh --issue --dns dns_namecheap -d yourdomain.com -d www.yourdomain.com

What happens here:

• acme.sh contacts Let's Encrypt.
• It creates special TXT records in your DNS zone via the Namecheap API.
• Let's Encrypt verifies you own the domain.
• A fresh SSL certificate is issued.

After success, your certificate files will be located under:

~/.acme.sh/yourdomain.com_ecc/

You’ll find:

• yourdomain.com.cer (Certificate)
• yourdomain.com.key (Private Key)
• fullchain.cer (Complete Certificate Chain)

Step 5: Prepare the Certificates

To install the certificate on Namecheap shared hosting, you need:

• The certificate file (.cer)
• The private key (.key)

Use cat to view and copy the contents:

cat ~/.acme.sh/yourdomain.com/yourdomain.com.key
cat ~/.acme.sh/yourdomain.com/yourdomain.com.cer
cat ~/.acme.sh/yourdomain.com/fullchain.cer

Keep these files ready. You will paste them into cPanel shortly.

Step 6: Install SSL Certificate via Namecheap cPanel

Since you can't reload Apache directly on shared hosting, you must manually install the certificate through Namecheap’s cPanel.

Follow these steps:

1. Log into your Namecheap cPanel.
2. Navigate to SSL/TLS → Manage SSL Sites.
3. Under Install an SSL Website:
   • Select your domain.
   • Paste:
     • Private Key: content of yourdomain.com.key
     • Certificate (CRT): content of yourdomain.com.cer
     • Certificate Authority Bundle (CABUNDLE): content of fullchain.cer (if asked)
4. Click Install Certificate.

That’s it. Within a few seconds, your site will be available over HTTPS.

Step 7: Set Up Auto-Renewal (Optional but Recommended)

acme.sh installs a cron job during setup to check for expiring certificates:

crontab -l

You should see something like:

10 14 * * * "~/.acme.sh/acme.sh" --cron --home "~/.acme.sh" > /dev/null

This tells acme.sh to run at 2:10 PM daily, and if a certificate is about to expire, it renews automatically. However, since Namecheap requires manual installation, you will need to reinstall the updated certificate manually every 60–90 days unless you upgrade hosting to one supporting AutoSSL.