How to Install LOMP Stack (OpenLiteSpeed, MySQL, and PHP) on Ubuntu 24.04

OpenLiteSpeed is a lightweight and open-source version of the LiteSpeed Server developed by LiteSpeed Technologies. It supports Apache Rewrite rules, HTTP/2 and HTTP/3, and TLS v1.3 and QUIC protocols. It comes with a WebGUI-based Administration panel, making it different from other servers and easier to manage.

The LOMP Stack is an acronym for Linux, OpenLiteSpeed, MySQL/MariaDB, and PHP. Litespeed servers are known for their speed, especially with PHP, which integrates using the LiteSpeed Server Application Programming Interface (LSAPI). The LiteSpeed PHP (LSPHP) interpreter serves dynamic PHP pages via LSAPI.

This tutorial will show you how to install an OpenLiteSpeed Server on Ubuntu 24.04.

Prerequisites

• A server running Ubuntu 24.04.
• A non-root user with sudo privileges.
• A fully qualified domain name (FQDN) like example.com pointing to the server.
• Make sure everything is updated.
• $ sudo apt update
  $ sudo apt upgrade
  
• Few packages that your system needs.
• $ sudo apt install wget curl nano ufw software-properties-common dirmngr apt-transport-https gnupg2 ca-certificates lsb-release ubuntu-keyring unzip -y
Some of these packages may already be installed on your system.

Step 1 – Configure Firewall

The first step is to configure the firewall. Debian comes with ufw (Uncomplicated Firewall) by default.

Check if the firewall is running.

$ sudo ufw status

You will get the following output.

Status: inactive

Allow SSH port so that the firewall doesn’t break the current connection upon enabling it.

$ sudo ufw allow OpenSSH

Allow HTTP and HTTPS ports as well.

$ sudo ufw allow http
$ sudo ufw allow https

Open ports related to Openlitespeed.

$ sudo ufw allow 7080/tcp

Enable the Firewall

$ sudo ufw enable


Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup


Check the status of the firewall again.

$ sudo ufw status

You should see a similar output.

Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
80/tcp ALLOW Anywhere
443 ALLOW Anywhere
7080/tcp ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
7080/tcp (v6) ALLOW Anywhere (v6)

Step 2 – Install OpenLiteSpeed

We will install OpenLiteSpeed by compiling from the source code. Download the OpenLiteSpeed source code file. You can get the link to the latest source code file from the OpenLiteSpeed official downloads page. The 1.7.19 version is the current stable version available.

$ wget https://openlitespeed.org/packages/openlitespeed-1.7.19.src.tgz

Extract the file.

$ tar -zxf openlitespeed-*.tgz

Switch to the extracted directory.

$ cd openlitespeed-1.7.19

Build the server package.

$ sudo ./build.sh

You might have to wait a good 5-10 minutes for the process to finish. Ignore any warnings you receive during the process. You will receive the following output when it is finished.

...............
[100%] Linking CXX shared library modpagespeed.so
/usr/bin/ld: warning: 140.x25519-asm-x86_64.o.o: missing .note.GNU-stack section implies executable stack
/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
[100%] Built target modpagespeed
Start to pack files.
-e Building finished, please run ./install.sh for installation.
-e You may want to update the ols.conf to change the settings before installation.
-e Enjoy.

Once the process is finished, open the file ols.conf for editing.

$ sudo nano ols.conf

Edit the file as shown below.

#If you want to change the default values, please update this file.
#
SERVERROOT=/usr/local/lsws
OPENLSWS_USER=nobody
OPENLSWS_GROUP=nobody
OPENLSWS_ADMIN=navjot
OPENLSWS_ADMINSSL=yes
OPENLSWS_ADMINPORT=7080
USE_LSPHP7=yes
DEFAULT_TMP_DIR=/tmp/lshttpd
PID_FILE=/tmp/lshttpd/lshttpd.pid
OPENLSWS_EXAMPLEPORT=8088

#You can set password here
#OPENLSWS_PASSWORD=

Don’t add your password here. We will set the password later using the command line. Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.

Now that OpenLiteSpeed is built, let us install it.

$ sudo ./install.sh

The installer script installs and enables the lsws service for the server. You will receive the following output when finished.

Updating webcache manager, please waiting ...
Downloading latest shared code tar file...
Checking tar file md5...
Removing existing shared code directory...
Extracting downloaded shared code...
Removing local shared code tar file...
Updating lscmctl script...
Done!

-e Installation finished, Enjoy!

-e Your webAdmin password is kXjWTl5j, written to file /usr/local/lsws/adminpasswd.

Start the OpenLiteSpeed server.

$ sudo systemctl start lsws

Check the status of the service.

$ sudo systemctl status lsws

? lshttpd.service - OpenLiteSpeed HTTP Server
Loaded: loaded (/usr/lib/systemd/system/lshttpd.service; enabled; preset: enabled)
Active: active (running) since Sun 2024-06-02 12:58:44 UTC; 3s ago
Process: 52583 ExecStart=/usr/local/lsws/bin/lswsctrl start (code=exited, status=0/SUCCESS)
Main PID: 52604 (litespeed)
CGroup: /system.slice/lshttpd.service
??52604 "openlitespeed (lshttpd - main)"
??52610 "openlitespeed (lscgid)"
??52623 "openlitespeed (lshttpd - #01)"
??52624 lsphp

Jun 02 12:58:42 lompserver systemd[1]: Starting lshttpd.service – OpenLiteSpeed HTTP Server…
Jun 02 12:58:42 lompserver lswsctrl[52583]: [OK] litespeed: pid=52604.
Jun 02 12:58:44 lompserver systemd[1]: Started lshttpd.service – OpenLiteSpeed HTTP Server.

Check the version of the server installed.$ /usr/local/lsws/bin/lshttpd -v
LiteSpeed/1.7.19 Open (BUILD built: Tue Apr 16 15:14:26 UTC 2024)
module versions:
lsquic 3.3.2
modgzip 1.1
cache 1.66
mod_security 1.4 (with libmodsecurity v3.0.12)

Create the Administrator Password

You can use the administrator password given during the installation process. However, you should create your own by resetting it. Run the password reset script.

$ sudo /usr/local/lsws/admin/misc/admpass.sh

You will get the following output. Choose your username and set a strong password.

Please specify the user name of administrator.
This is the user name required to login the administration Web interface.
User name [admin]: navjot

Please specify the administrator's password.
This is the password required to login the administration Web interface.

Password:
Retype password:
Administrator's username/password is updated successfully!

You can now use the new administrator password.

Open http://<YOURSERVERIP>:7080 to access OpenLiteSpeed’s administration panel. On your first login, your browser will warn that your connection is not private. Click Advanced and click “Accept the risk and Continue” (in the case of Firefox) or “Proceed to <YOURSERVERIP>(unsafe)” (in the case of Chromium-based browser). You won’t see the warning again.

You should see the login page.

Enter the credentials you set earlier, and press the Login button to proceed.

You will get the following screen.

Step 3 – Install MySQL

Before proceeding ahead with the MySQL installation, we need to update the LiteSpeed repository. The Litespeed repository added via the installer doesn’t work properly.

Open the file /etc/apt/sources.list.d/lst_debian_repo.list for editing.

$ sudo nano /etc/apt/sources.list.d/lst_debian_repo.list

Change the file contents by adding the Ubuntu 24.04 release name (noble) to the repository URL.

deb http://rpms.litespeedtech.com/debian/ noble main

Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.

Install the MySQL server.

$ sudo apt install mysql-server

MySQL service is automatically started and running post-install.

Check the status of the service.

$ sudo systemctl status mysql

You will get the following output.

? mysql.service - MySQL Community Server
Loaded: loaded (/usr/lib/systemd/system/mysql.service; enabled; preset: enabled)
Active: active (running) since Sun 2024-06-02 13:42:12 UTC; 8min ago
Process: 57889 ExecStartPre=/usr/share/mysql/mysql-systemd-start pre (code=exited, status=0/SUCCESS)
Main PID: 57898 (mysqld)
Status: "Server is operational"
Tasks: 37 (limit: 2263)
Memory: 370.6M (peak: 386.9M)
CPU: 6.762s
CGroup: /system.slice/mysql.service
??57898 /usr/sbin/mysqld

Jun 02 13:42:11 lompserver systemd[1]: Starting mysql.service – MySQL Community Server…

Run the MySQL security script.

$ sudo mysql_secure_installation

You will be asked to install the Validate Password Component. Press Y to proceed.Securing the MySQL server deployment.

Connecting to MySQL using a blank password.

VALIDATE PASSWORD COMPONENT can be used to test passwords
and improve security. It checks the strength of password
and allows the users to set only those passwords which are
secure enough. Would you like to setup VALIDATE PASSWORD component?

Press y|Y for Yes, any other key for No: y

Next, you will be asked to choose the strength of the password. Select 2 for Strong and proceed.

There are three levels of password validation policy:

LOW Length >= 8
MEDIUM Length >= 8, numeric, mixed case, and special characters
STRONG Length >= 8, numeric, mixed case, special characters and dictionary file

Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 2

MySQL installation won’t ask you to set a root password because the default authentication type is auth_socket which depends on your Linux system authentication. You can however change it later.

Skipping password set for root as authentication with auth_socket is used by default.
If you would like to use password authentication instead, this can be done with the "ALTER_USER" command.
See https://dev.mysql.com/doc/refman/8.0/en/alter-user.html#alter-user-password-management for more information.

Next, you will be asked certain questions to improve MySQL security. Type Y to remove anonymous users, disallow remote root logins, remove the test database, and reload the privilege tables.

By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.

Remove anonymous users? (Press y|Y for Yes, any other key for No) : y
Success.

Normally, root should only be allowed to connect from
‘localhost’. This ensures that someone cannot guess at
the root password from the network.

Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y
Success.

By default, MySQL comes with a database named ‘test’ that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.

Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
– Dropping test database…
Success.

– Removing privileges on test database…
Success.

Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.

Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Success.

All done!

You can enter the MySQL shell by typing sudo mysql on the command line.

Step 4 – Install PHP

Since we built our package from the source, it compiles and builds an old version of PHP which is not recommended for use. You can check it via the following command.

$ /usr/local/lsws/fcgi-bin/lsphp -v
PHP 5.6.40 (litespeed) (built: May 10 2023 23:03:31)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies

Therefore, we need to build and install the latest version of PHP. But, before we proceed, we need to install the build tools.

$ sudo apt install build-essential autoconf libtool bison re2c pkg-config

The next step is to install the packages required by the PHP build process.

$ sudo apt install libssl-dev libsqlite3-dev zlib1g-dev libcurl4-openssl-dev libonig-dev libzip-dev libmemcached-dev libreadline-dev libgmp-dev libpng-dev libjpeg-dev libwebp-dev libxpm-dev libicu-dev libfreetype6-dev libxslt-dev libldb-dev libtidy-dev libvips-dev libsodium-dev libavif-dev libldap2-dev libxml2-dev libkrb5-dev libc-client2007e-dev libpq-dev libargon2-1 libargon2-dev libbz2-dev libffi-dev libc-client-dev libpspell-dev flex libgmp3-dev libmcrypt-dev libmhash-dev freetds-dev libmysqlclient-dev libncurses5-dev libpcre3-dev libaspell-dev librecode-dev libsnmp-dev

Next, download the PHP source code. We will download the PHP 8.3.7 version which is the latest version available at the time of writing.

$ cd ~
$ wget https://www.php.net/distributions/php-8.3.7.tar.gz

Extract the files.

$ tar -xzf php-8.3.7.tar.gz

Switch to the downloaded directory.

$ cd php-8.3.7

Next, run the configure script with the following options. The --enable-litespeed option is essential.

$ sudo ./configure --prefix=/usr/local/lsws/lsphp83 --enable-bcmath --enable-calendar --enable-exif --enable-ftp --enable-gd --enable-intl --enable-mbregex --enable-mbstring --enable-mysqlnd --enable-opcache --enable-shmop --enable-soap --enable-sockets --enable-sysvsem --enable-sysvshm --with-avif --with-curl --with-ffi --with-freetype --with-gettext --with-gmp --with-imap --with-imap-ssl --with-jpeg --with-kerberos --with-libxml --with-ldap --with-mysqli --with-mysql-sock=/run/mysqld/mysqld.sock --with-openssl --with-password-argon2 --with-pdo-mysql=mysqlnd --with-pdo-pgsql=/usr/bin/pg_config --with-pear --with-pspell --with-readline --with-sodium --with-tidy --with-webp --with-xpm --with-xsl --with-zip --with-zlib --enable-litespeed

You should get the following output once the script is finished.

+--------------------------------------------------------------------+
| License: |
| This software is subject to the PHP License, available in this |
| distribution in the file LICENSE. By continuing this installation |
| process, you are bound by the terms of this license agreement. |
| If you do not agree with the terms of this license, you must abort |
| the installation process at this point. |
+--------------------------------------------------------------------+

Thank you for using PHP.

Compile the source.

$ sudo make -j $(nproc)

You will receive a similar output once finished.

Generating phar.php
Generating phar.phar
PEAR package PHP_Archive not installed: generated phar will require PHP's phar extension be enabled.
directorytreeiterator.inc
phar.inc
invertedregexiterator.inc
directorygraphiterator.inc
pharcommand.inc
clicommand.inc

Build complete.
Don’t forget to run ‘make test’.

Once you are finished, run the following command to try and check the version.

$ ./sapi/litespeed/php -v
PHP 8.3.7 (litespeed) (built: Jun 3 2024 05:28:43)
Copyright (c) The PHP Group
Zend Engine v4.3.7, Copyright (c) Zend Technologies

Install PHP.

$ sudo make install

You will get the following output.

Installing shared extensions: /usr/local/lsws/lsphp83/lib/php/extensions/no-debug-non-zts-20230831/
Installing PHP CLI binary: /usr/local/lsws/lsphp83/bin/
Installing PHP CLI man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing PHP LiteSpeed binary: /usr/local/lsws/lsphp83/bin/
Installing phpdbg binary: /usr/local/lsws/lsphp83/bin/
Installing phpdbg man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing PHP CGI binary: /usr/local/lsws/lsphp83/bin/
Installing PHP CGI man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing build environment: /usr/local/lsws/lsphp83/lib/php/build/
Installing header files: /usr/local/lsws/lsphp83/include/php/
Installing helper programs: /usr/local/lsws/lsphp83/bin/
program: phpize
program: php-config
Installing man pages: /usr/local/lsws/lsphp83/php/man/man1/
page: phpize.1
page: php-config.1
Installing PEAR environment: /usr/local/lsws/lsphp83/lib/php/
[PEAR] Archive_Tar - installed: 1.4.14
[PEAR] Console_Getopt - installed: 1.4.3
[PEAR] Structures_Graph- installed: 1.1.1
[PEAR] XML_Util - installed: 1.4.5
warning: pear/PEAR dependency package "pear/Archive_Tar" installed version 1.4.14 is not the recommended version 1.4.4
[PEAR] PEAR - installed: 1.10.15
Wrote PEAR system config file at: /usr/local/lsws/lsphp83/etc/pear.conf
You may want to add: /usr/local/lsws/lsphp83/lib/php to your php.ini include_path
Installing PDO headers: /usr/local/lsws/lsphp83/include/php/ext/pdo/

Verify the PHP installation. There are two PHP binaries available in the /usr/local/lsws/lsphp83/bin directory. One is the normal php which is the command-line version and the other is the Litespeed version lsphp. The second one is the one we will be using.

$ /usr/local/lsws/lsphp83/bin/lsphp -v
PHP 8.3.7 (litespeed) (built: Jun 3 2024 05:28:43)
Copyright (c) The PHP Group
Zend Engine v4.3.7, Copyright (c) Zend Technologies

You can check the list of enabled PHP modules.

$ /usr/local/lsws/lsphp83/bin/php --modules
[PHP Modules]
bcmath
calendar
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
imap
intl
json
ldap
libxml
mbstring
mysqli
mysqlnd
openssl
pcre
PDO
pdo_mysql
pdo_pgsql
pdo_sqlite
Phar
posix
pspell
random
readline
Reflection
session
shmop
SimpleXML
soap
sockets
sodium
SPL
sqlite3
standard
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlwriter
xsl
zip
zlib

[Zend Modules]

Copy the php.ini-production from the install folder to the /usr/local/lsws/lsphp83/lib folder.

$ sudo cp php.ini-production /usr/local/lsws/lsphp83/lib/php.ini

We will configure OpenLiteSpeed to work with PHP later.

Open the php.ini for editing.

$ sudo nano /usr/local/lsws/lsphp83/lib/php.ini

Find the variable include_path and change its value as shown below.

$ ;;;;;;;;;;;;;;;;;;;;;;;;;
; Paths and Directories ;
;;;;;;;;;;;;;;;;;;;;;;;;;
; UNIX: "/path1:/path2"
include_path = "/usr/local/lsws/lsphp83/lib/php"

Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.

Step 5 – Configure MySQL

Log in to the MySQL shell.

$ sudo mysql

Create a test database. Replace testdb with the appropriate database name of your choice.

mysql> CREATE DATABASE testdb;

Create a test user. Replace testuser with an appropriate username. Replace Your_Password123 with a strong password.

mysql> CREATE USER 'testuser'@'localhost' IDENTIFIED BY 'Your_Password123';

Grant all privileges on the database to the user.

mysql> GRANT ALL PRIVILEGES ON testdb.* TO 'testuser'@'localhost';

Flush user privileges.

mysql> FLUSH PRIVILEGES;

Exit the MySQL shell.

mysql> exit

Step 6 – Configure OpenLiteSpeed

Switch the HTTP port back to 80

Let us change the default HTTP port to 80. Log in to your administration panel at http://<YOURSERVERIP>:7080 with the credentials you just created.

Visit the Listeners section from the left. You will see the default listeners with port 8080.

Click the View button to see the detailed configuration. On the next page under Listener Default > General Page, click on the Edit icon and change the port from 8080 to 80.

Click Save and restart the server by clicking the Graceful restart button.

Open the URL http://<YOURSERVERIP> in your browser and you should get the following page.

Step 7 – Configure PHP

In this step, we need to associate our copy of PHP 8.3 with the server.

Click on the Server Configuration section on the left and then on the tab External App. You will see an existing LiteSpeed App for PHP. We will make some edits to it.

Click on the Edit button to edit the PHP app.

Next, match the configuration as shown below. Leave all the other fields blank.

Name: lsphp
Address: uds://tmp/lshttpd/lsphp.sock
Max Connections: 35
Environment: PHP_LSAPI_MAX_REQUESTS=500
PHP_LSAPI_CHILDREN=35
LSAPI_AVOID_FORK=200M
Initial Request Timeout (secs): 60
Retry Timeout : 0
Persistent Connection: Yes
Response Buffering: no
Start By Server: Yes(Through CGI Daemon)
Command: lsphp83/bin/lsphp
Back Log: 100
Instances: 1
Priority: 0
Memory Soft Limit (bytes): 2047M
Memory Hard Limit (bytes): 2047M
Process Soft Limit: 1400
Process Hard Limit: 1500

Click Save when finished.

Now that we have created our own PHP 8.3 app, we must tell the server to start using it. Since we edited the default listing, it is already configured. Restart the server by clicking on the Graceful restart button.

To test whether your PHP has been switched correctly, visit http://<YOURSERVERIP>/phpinfo.php in your browser.

Restart PHP

On OpenLiteSpeed, if you edit php.ini or install a new PHP module, restarting the server won’t show the changes. You will need to restart the PHP process for that. First, you will need to locate the process IDs for the lsphp process.

$ ps aux | grep lsphp
nobody 120093 0.0 0.8 123772 32920 ? S 06:35 0:00 lsphp
nobody 120111 0.0 0.4 123772 18980 ? Ss 06:38 0:00 lsphp
navjot 120139 0.0 0.0 6544 2304 pts/0 S+ 06:44 0:00 grep --color=auto lsphp

Manually kill the lsphp processes.

$ sudo kill -9 120093
$ sudo kill -9 120111

Restart the Server.

$ sudo systemctl restart lsws

Step 8 – Create VirtualHost

First, we need to create directories for our virtual host.

$ sudo mkdir /usr/local/lsws/example.com/{html,logs} -p

The html directory will hold the public files and the logs directory will contain server logs.

Next, open the Admin console, access the Virtual Hosts section from the left, and click the Add button.

Fill in the values as specified

Virtual Host Name: example.com
Virtual Host Root: $SERVER_ROOT/example.com/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Follow Symbolic Link: Yes
Enable Scripts/ExtApps: Yes
Restrained: Yes
External App Set UID Mode: Server UID

Click on the Save button when finished. You will get the following error because the configuration file doesn’t exist as of now. Click on the link to create the configuration file.

Click the Save button again to finish creating the Virtual Host.

Once the virtual host is created, go to Virtual Hosts -> Choose Virtual Host(example.com) -> General and modify the configuration as given.

Document Root: $VH_ROOT/html/
Domain Name: example.com
Enable GZIP Compression: Yes
Enable Brotli Compression: Yes

Click the Save button when finished. Next, we need to set up index files. Click the edit button against Index files below the General Section. Set the following options.

Use Server Index Files: No
Index files: index.php, index.html, index.htm
Auto Index: No

Click Save when done. Next, we need to choose Log files. Go to the Log section, click Edit against Virtual Host Log, and fill in the following values. Leave other settings unchanged.

Use Server’s Log: Yes
File Name: $VH_ROOT/logs/error.log
Log Level: ERROR
Rolling Size (bytes): 10M
Keep Days: 30
Compress Archive: Not Set

You can choose the Log Level as DEBUG if you are on a development machine.

Click Save and then click the plus sign in the Access Log section to add a new entry. Fill in the following values.

Log Control: Own Log File
File Name: $VH_ROOT/logs/access.log
Piped Logger: Not Set
Log Format: Not Set
Log Headers: Not Set
Rolling Size (bytes): 10M
Keep Days: 30
Compress Archive: Not Set
Bytes log: Not Set

Click Save when done. Next, we need to configure Access Control under the Security section. Set the following Values.

Allowed List: *
Denied List: Not set

Click Save when done. Next, we need to set the Script Handler Definition. Click the plus (+) sign to add a new definition. Set the following values.

Suffixes: php
Handler Type: LiteSpeed SAPI
Handler Name: [Server Level]: lsphp

Click Save when done. Next, we need to set Rewrite Control under the Rewrite section. Set the following values.

Enable Rewrite: Yes
Auto Load from .htaccess: Yes
Log Level: Not Set

Click Save when done. And at last, we need to set the Listeners. Go to the Listeners section and click on the View button against Default Listener. Then, click on the Add button against Virtual Host Mappings to add a new mapping and set the following values.

Virtual Host: example.com
Domains: example.com

Click Save when done. Now, click on the Graceful restart button to apply all the changes above and restart the server.

Step 9 – Install SSL

Setting up SSL in OpenLiteSpeed requires us to set up two certificates. A self-signed certificate for the overall server and a Let’s Encrypt site-specific server.

The administration panel already comes with a self-signed certificate pre-installed which is available in the /usr/local/lsws/admin/conf directory.

Let us create the Self Signed Certificate for the overall server first.

$ cd ~
$ openssl req -x509 -days 365 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes

You will get a similar output.

-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:example.com
Email Address []:[email protected]

You can press enter through all the fields and leave them empty. Fill in your domain for the Common name and your email address.

Create the directory for the self-signed certificates.

$ sudo mkdir /usr/local/lsws/certs

Copy the certificate to the /usr/local/lsws/certs directory.

$ sudo mv *.pem /usr/local/lsws/certs

We need to install Certbot to generate free SSL certificates offered by Let’s Encrypt.

You can either install Certbot using Debian’s repository or grab the latest version using the Snapd tool. We will be using the Snapd version. Ubuntu 24.04 comes comes with Snapd pre-installed.

Run the following commands to ensure that your version of Snapd is up to date.

$ sudo snap install core
$ sudo snap refresh core

Issue the following command to install Certbot.

$ sudo snap install --classic certbot

Use the following command to ensure that the Certbot command can be run by creating a symbolic link to the /usr/bin directory.

$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

Verify the installation.

$ certbot --version
certbot 2.10.0

Run the following command to generate an SSL Certificate.

Obtain the SSL certificate. The webroot directory is set to the public HTML directory configured earlier.

$ sudo certbot certonly --webroot -w /usr/local/lsws/example.com/html/ --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d example.com

Generate a Diffie-Hellman group certificate.

$ sudo openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096

Check the Certbot renewal scheduler service.

$ sudo systemctl list-timers

You will find snap.certbot.renew.service as one of the services scheduled to run.

NEXT LEFT LAST PASSED UNIT ACTIVATES
Mon 2024-06-03 07:20:00 UTC 5min Mon 2024-06-03 07:10:02 UTC 4min 11s ago sysstat-collect.timer sysstat-collect.service
Mon 2024-06-03 08:29:00 UTC 1h 14min - - snap.certbot.renew.timer snap.certbot.renew.service
Mon 2024-06-03 08:50:32 UTC 1h 36min Mon 2024-06-03 07:04:04 UTC 10min ago fwupd-refresh.timer fwupd-refresh.service

To check whether the SSL renewal is working fine, do a dry run of the process.

$ sudo certbot renew --dry-run

If you see no errors, you are all set. Your certificate will renew automatically.

Now open the Admin console, go to Listeners >> Add New Listener, and add the following values.

Listener Name: SSL
IP Address: ANY IPv4
Port: 443
Secure: Yes

Virtual Host: example.com
Domains: example.com

Click Save when done. Next, go to the Virtual Host Mappings section under the SSL Listener by clicking on SSL, clicking on the Add button, and filling in the following values.

Click Save when done. Next, go to Listeners >> SSL Listener >> SSL Tab >>SSL Private Key & Certificate (Edit button) and fill in the following values for the self-signed certificate we created before.

Private Key File: $SERVER_ROOT/certs/key.pem
Certificate File: $SERVER_ROOT/certs/cert.pem
Chained Certificate: Yes

Click Save when done. Next, go to Listeners >> SSL Listener >> SSL Tab >> SSL Protocol (Edit button) and fill in the following values for the SSL protocol and cipher details.

Protocol Version: TLS v1.2 TLS v1.3
Ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
Enable ECDH Key Exchange: Yes
Enable DH Key Exchange: Yes
DH Parameter: /etc/ssl/certs/dhparam.pem

Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> SSL Private Key & Certificate (Edit button) and fill in the following values with the Let’s Encrypt Certificate.

Private Key File: /etc/letsencrypt/live/example.com/privkey.pem
Certificate File: /etc/letsencrypt/live/example.com/fullchain.pem
Chained Certificate: Yes

Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> OCSP Stapling (Edit button) and fill in the following values to enable OCSP Stapling.

Enable OCSP Stapling: Yes
OCSP Response Max Age(Secs): 300
OCSP Responder: http://r3.o.lencr.org

Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> Security (Edit button) and fill in the following values to enable HTTP3/QUIC protocol.

ALPN: Enable HTTP/2 and HTTP/3
Enable HTTP3/QUIC: Yes

We don’t need to enable other options because they are on by default.

Click Save when finished.

Restart the server by clicking on the Graceful restart button.

Step 10 – Test Site

Create a Test file in your html directory.

$ sudo nano /usr/local/lsws/example.com/html/index.php

Paste the following code in the Nano editor.

<html>
<head>
<h2>OpenLiteSpeed Server Install Test</h2>
</head>
<body>
<?php echo '<p>Hello,</p>';
// Define PHP variables for the MySQL connection.
$servername = "localhost";
$username = "testuser";
$password = "Your_Password123";

// Create a MySQL connection.
$conn = mysqli_connect($servername, $username, $password);

// Report if the connection fails or is successful.
if (!$conn) {
exit('<p>Your connection has failed.<p>' . mysqli_connect_error());
}
echo '<p>You have connected successfully.</p>';
?>
</body>
</html>

Save the file by pressing Ctrl + X and entering Y when prompted. Open the URL https://example.com in a browser and you should see the following page.

The test site is fully functional. You can start using the server to serve dynamic PHP websites and applications.

Conclusion

This concludes our tutorial on installing LOMP Stack (OpenLiteSpeed, MySQL, and PHP) on a Ubuntu 24.04 server. If you have any questions, post them in the comments below.