OpenLiteSpeed is a lightweight and open-source version of the LiteSpeed Server developed by LiteSpeed Technologies. It supports Apache Rewrite rules, HTTP/2 and HTTP/3, and TLS v1.3 and QUIC protocols. It comes with a WebGUI-based Administration panel, making it different from other servers and easier to manage.
The LOMP Stack is an acronym for Linux, OpenLiteSpeed, MySQL/MariaDB, and PHP. Litespeed servers are known for their speed, especially with PHP, which integrates using the LiteSpeed Server Application Programming Interface (LSAPI). The LiteSpeed PHP (LSPHP) interpreter serves dynamic PHP pages via LSAPI.
This tutorial will show you how to install an OpenLiteSpeed Server on Ubuntu 24.04.
Prerequisites
- A server running Ubuntu 24.04.
- A non-root user with sudo privileges.
- A fully qualified domain name (FQDN) like
example.com
pointing to the server. - Make sure everything is updated.
- $ sudo apt update
$ sudo apt upgrade - Few packages that your system needs.
$ sudo apt install wget curl nano ufw software-properties-common dirmngr apt-transport-https gnupg2 ca-certificates lsb-release ubuntu-keyring unzip -y
Some of these packages may already be installed on your system.
Step 1 – Configure Firewall
The first step is to configure the firewall. Debian comes with ufw (Uncomplicated Firewall) by default.
Check if the firewall is running.
$ sudo ufw status
You will get the following output.
Status: inactive
Allow SSH port so that the firewall doesn’t break the current connection upon enabling it.
$ sudo ufw allow OpenSSH
Allow HTTP and HTTPS ports as well.
$ sudo ufw allow http
$ sudo ufw allow https
Open ports related to Openlitespeed.
$ sudo ufw allow 7080/tcp
Enable the Firewall
$ sudo ufw enable
Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
Check the status of the firewall again.
$ sudo ufw status
You should see a similar output.
Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
80/tcp ALLOW Anywhere
443 ALLOW Anywhere
7080/tcp ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)
7080/tcp (v6) ALLOW Anywhere (v6)
Step 2 – Install OpenLiteSpeed
We will install OpenLiteSpeed by compiling from the source code. Download the OpenLiteSpeed source code file. You can get the link to the latest source code file from the OpenLiteSpeed official downloads page. The 1.7.19 version is the current stable version available.
$ wget https://openlitespeed.org/packages/openlitespeed-1.7.19.src.tgz
Extract the file.
$ tar -zxf openlitespeed-*.tgz
Switch to the extracted directory.
$ cd openlitespeed-1.7.19
Build the server package.
$ sudo ./build.sh
You might have to wait a good 5-10 minutes for the process to finish. Ignore any warnings you receive during the process. You will receive the following output when it is finished.
...............
[100%] Linking CXX shared library modpagespeed.so
/usr/bin/ld: warning: 140.x25519-asm-x86_64.o.o: missing .note.GNU-stack section implies executable stack
/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
[100%] Built target modpagespeed
Start to pack files.
-e Building finished, please run ./install.sh for installation.
-e You may want to update the ols.conf to change the settings before installation.
-e Enjoy.
Once the process is finished, open the file ols.conf
for editing.
$ sudo nano ols.conf
Edit the file as shown below.
#If you want to change the default values, please update this file.
#
SERVERROOT=/usr/local/lsws
OPENLSWS_USER=nobody
OPENLSWS_GROUP=nobody
OPENLSWS_ADMIN=navjot
OPENLSWS_ADMINSSL=yes
OPENLSWS_ADMINPORT=7080
USE_LSPHP7=yes
DEFAULT_TMP_DIR=/tmp/lshttpd
PID_FILE=/tmp/lshttpd/lshttpd.pid
OPENLSWS_EXAMPLEPORT=8088
#You can set password here
#OPENLSWS_PASSWORD=
Don’t add your password here. We will set the password later using the command line. Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.
Now that OpenLiteSpeed is built, let us install it.
$ sudo ./install.sh
The installer script installs and enables the lsws
service for the server. You will receive the following output when finished.
Updating webcache manager, please waiting ...
Downloading latest shared code tar file...
Checking tar file md5...
Removing existing shared code directory...
Extracting downloaded shared code...
Removing local shared code tar file...
Updating lscmctl script...
Done!
-e Installation finished, Enjoy!
-e Your webAdmin password is kXjWTl5j, written to file /usr/local/lsws/adminpasswd.
Start the OpenLiteSpeed server.
$ sudo systemctl start lsws
Check the status of the service.
$ sudo systemctl status lsws
? lshttpd.service - OpenLiteSpeed HTTP Server
Loaded: loaded (/usr/lib/systemd/system/lshttpd.service; enabled; preset: enabled)
Active: active (running) since Sun 2024-06-02 12:58:44 UTC; 3s ago
Process: 52583 ExecStart=/usr/local/lsws/bin/lswsctrl start (code=exited, status=0/SUCCESS)
Main PID: 52604 (litespeed)
CGroup: /system.slice/lshttpd.service
??52604 "openlitespeed (lshttpd - main)"
??52610 "openlitespeed (lscgid)"
??52623 "openlitespeed (lshttpd - #01)"
??52624 lsphp
Jun 02 12:58:42 lompserver systemd[1]: Starting lshttpd.service – OpenLiteSpeed HTTP Server…
Jun 02 12:58:42 lompserver lswsctrl[52583]: [OK] litespeed: pid=52604.
Jun 02 12:58:44 lompserver systemd[1]: Started lshttpd.service – OpenLiteSpeed HTTP Server.
Check the version of the server installed.$ /usr/local/lsws/bin/lshttpd -v
LiteSpeed/1.7.19 Open (BUILD built: Tue Apr 16 15:14:26 UTC 2024)
module versions:
lsquic 3.3.2
modgzip 1.1
cache 1.66
mod_security 1.4 (with libmodsecurity v3.0.12)
Create the Administrator Password
You can use the administrator password given during the installation process. However, you should create your own by resetting it. Run the password reset script.
$ sudo /usr/local/lsws/admin/misc/admpass.sh
You will get the following output. Choose your username and set a strong password.
Please specify the user name of administrator.
This is the user name required to login the administration Web interface.
User name [admin]: navjot
Please specify the administrator's password.
This is the password required to login the administration Web interface.
Password:
Retype password:
Administrator's username/password is updated successfully!
You can now use the new administrator password.
Open http://<YOURSERVERIP>:7080
to access OpenLiteSpeed’s administration panel. On your first login, your browser will warn that your connection is not private. Click Advanced and click “Accept the risk and Continue” (in the case of Firefox) or “Proceed to <YOURSERVERIP>(unsafe)
” (in the case of Chromium-based browser). You won’t see the warning again.
You should see the login page.
Enter the credentials you set earlier, and press the Login button to proceed.
You will get the following screen.
Step 3 – Install MySQL
Before proceeding ahead with the MySQL installation, we need to update the LiteSpeed repository. The Litespeed repository added via the installer doesn’t work properly.
Open the file /etc/apt/sources.list.d/lst_debian_repo.list
for editing.
$ sudo nano /etc/apt/sources.list.d/lst_debian_repo.list
Change the file contents by adding the Ubuntu 24.04 release name (noble
) to the repository URL.
deb http://rpms.litespeedtech.com/debian/ noble main
Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.
Install the MySQL server.
$ sudo apt install mysql-server
MySQL service is automatically started and running post-install.
Check the status of the service.
$ sudo systemctl status mysql
You will get the following output.
? mysql.service - MySQL Community Server
Loaded: loaded (/usr/lib/systemd/system/mysql.service; enabled; preset: enabled)
Active: active (running) since Sun 2024-06-02 13:42:12 UTC; 8min ago
Process: 57889 ExecStartPre=/usr/share/mysql/mysql-systemd-start pre (code=exited, status=0/SUCCESS)
Main PID: 57898 (mysqld)
Status: "Server is operational"
Tasks: 37 (limit: 2263)
Memory: 370.6M (peak: 386.9M)
CPU: 6.762s
CGroup: /system.slice/mysql.service
??57898 /usr/sbin/mysqld
Jun 02 13:42:11 lompserver systemd[1]: Starting mysql.service – MySQL Community Server…
Run the MySQL security script.
$ sudo mysql_secure_installation
You will be asked to install the Validate Password Component
. Press Y
to proceed.Securing the MySQL server deployment.
Connecting to MySQL using a blank password.
VALIDATE PASSWORD COMPONENT can be used to test passwords
and improve security. It checks the strength of password
and allows the users to set only those passwords which are
secure enough. Would you like to setup VALIDATE PASSWORD component?
Press y|Y for Yes, any other key for No: y
Next, you will be asked to choose the strength of the password. Select 2
for Strong and proceed.
There are three levels of password validation policy:
LOW Length >= 8
MEDIUM Length >= 8, numeric, mixed case, and special characters
STRONG Length >= 8, numeric, mixed case, special characters and dictionary file
Please enter 0 = LOW, 1 = MEDIUM and 2 = STRONG: 2
MySQL installation won’t ask you to set a root password because the default authentication type is auth_socket
which depends on your Linux system authentication. You can however change it later.
Skipping password set for root as authentication with auth_socket is used by default.
If you would like to use password authentication instead, this can be done with the "ALTER_USER" command.
See https://dev.mysql.com/doc/refman/8.0/en/alter-user.html#alter-user-password-management for more information.
Next, you will be asked certain questions to improve MySQL security. Type Y to remove anonymous users, disallow remote root logins, remove the test database, and reload the privilege tables.
By default, a MySQL installation has an anonymous user,
allowing anyone to log into MySQL without having to have
a user account created for them. This is intended only for
testing, and to make the installation go a bit smoother.
You should remove them before moving into a production
environment.
Remove anonymous users? (Press y|Y for Yes, any other key for No) : y
Success.
Normally, root should only be allowed to connect from
‘localhost’. This ensures that someone cannot guess at
the root password from the network.
Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y
Success.
By default, MySQL comes with a database named ‘test’ that
anyone can access. This is also intended only for testing,
and should be removed before moving into a production
environment.
Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
– Dropping test database…
Success.
– Removing privileges on test database…
Success.
Reloading the privilege tables will ensure that all changes
made so far will take effect immediately.
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Success.
All done!
You can enter the MySQL shell by typing sudo mysql
on the command line.
Step 4 – Install PHP
Since we built our package from the source, it compiles and builds an old version of PHP which is not recommended for use. You can check it via the following command.
$ /usr/local/lsws/fcgi-bin/lsphp -v
PHP 5.6.40 (litespeed) (built: May 10 2023 23:03:31)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
Therefore, we need to build and install the latest version of PHP. But, before we proceed, we need to install the build tools.
$ sudo apt install build-essential autoconf libtool bison re2c pkg-config
The next step is to install the packages required by the PHP build process.
$ sudo apt install libssl-dev libsqlite3-dev zlib1g-dev libcurl4-openssl-dev libonig-dev libzip-dev libmemcached-dev libreadline-dev libgmp-dev libpng-dev libjpeg-dev libwebp-dev libxpm-dev libicu-dev libfreetype6-dev libxslt-dev libldb-dev libtidy-dev libvips-dev libsodium-dev libavif-dev libldap2-dev libxml2-dev libkrb5-dev libc-client2007e-dev libpq-dev libargon2-1 libargon2-dev libbz2-dev libffi-dev libc-client-dev libpspell-dev flex libgmp3-dev libmcrypt-dev libmhash-dev freetds-dev libmysqlclient-dev libncurses5-dev libpcre3-dev libaspell-dev librecode-dev libsnmp-dev
Next, download the PHP source code. We will download the PHP 8.3.7 version which is the latest version available at the time of writing.
$ cd ~
$ wget https://www.php.net/distributions/php-8.3.7.tar.gz
Extract the files.
$ tar -xzf php-8.3.7.tar.gz
Switch to the downloaded directory.
$ cd php-8.3.7
Next, run the configure script with the following options. The --enable-litespeed
option is essential.
$ sudo ./configure --prefix=/usr/local/lsws/lsphp83 --enable-bcmath --enable-calendar --enable-exif --enable-ftp --enable-gd --enable-intl --enable-mbregex --enable-mbstring --enable-mysqlnd --enable-opcache --enable-shmop --enable-soap --enable-sockets --enable-sysvsem --enable-sysvshm --with-avif --with-curl --with-ffi --with-freetype --with-gettext --with-gmp --with-imap --with-imap-ssl --with-jpeg --with-kerberos --with-libxml --with-ldap --with-mysqli --with-mysql-sock=/run/mysqld/mysqld.sock --with-openssl --with-password-argon2 --with-pdo-mysql=mysqlnd --with-pdo-pgsql=/usr/bin/pg_config --with-pear --with-pspell --with-readline --with-sodium --with-tidy --with-webp --with-xpm --with-xsl --with-zip --with-zlib --enable-litespeed
You should get the following output once the script is finished.
+--------------------------------------------------------------------+
| License: |
| This software is subject to the PHP License, available in this |
| distribution in the file LICENSE. By continuing this installation |
| process, you are bound by the terms of this license agreement. |
| If you do not agree with the terms of this license, you must abort |
| the installation process at this point. |
+--------------------------------------------------------------------+
Thank you for using PHP.
Compile the source.
$ sudo make -j $(nproc)
You will receive a similar output once finished.
Generating phar.php
Generating phar.phar
PEAR package PHP_Archive not installed: generated phar will require PHP's phar extension be enabled.
directorytreeiterator.inc
phar.inc
invertedregexiterator.inc
directorygraphiterator.inc
pharcommand.inc
clicommand.inc
Build complete.
Don’t forget to run ‘make test’.
Once you are finished, run the following command to try and check the version.
$ ./sapi/litespeed/php -v
PHP 8.3.7 (litespeed) (built: Jun 3 2024 05:28:43)
Copyright (c) The PHP Group
Zend Engine v4.3.7, Copyright (c) Zend Technologies
Install PHP.
$ sudo make install
You will get the following output.
Installing shared extensions: /usr/local/lsws/lsphp83/lib/php/extensions/no-debug-non-zts-20230831/
Installing PHP CLI binary: /usr/local/lsws/lsphp83/bin/
Installing PHP CLI man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing PHP LiteSpeed binary: /usr/local/lsws/lsphp83/bin/
Installing phpdbg binary: /usr/local/lsws/lsphp83/bin/
Installing phpdbg man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing PHP CGI binary: /usr/local/lsws/lsphp83/bin/
Installing PHP CGI man page: /usr/local/lsws/lsphp83/php/man/man1/
Installing build environment: /usr/local/lsws/lsphp83/lib/php/build/
Installing header files: /usr/local/lsws/lsphp83/include/php/
Installing helper programs: /usr/local/lsws/lsphp83/bin/
program: phpize
program: php-config
Installing man pages: /usr/local/lsws/lsphp83/php/man/man1/
page: phpize.1
page: php-config.1
Installing PEAR environment: /usr/local/lsws/lsphp83/lib/php/
[PEAR] Archive_Tar - installed: 1.4.14
[PEAR] Console_Getopt - installed: 1.4.3
[PEAR] Structures_Graph- installed: 1.1.1
[PEAR] XML_Util - installed: 1.4.5
warning: pear/PEAR dependency package "pear/Archive_Tar" installed version 1.4.14 is not the recommended version 1.4.4
[PEAR] PEAR - installed: 1.10.15
Wrote PEAR system config file at: /usr/local/lsws/lsphp83/etc/pear.conf
You may want to add: /usr/local/lsws/lsphp83/lib/php to your php.ini include_path
Installing PDO headers: /usr/local/lsws/lsphp83/include/php/ext/pdo/
Verify the PHP installation. There are two PHP binaries available in the /usr/local/lsws/lsphp83/bin
directory. One is the normal php
which is the command-line version and the other is the Litespeed version lsphp
. The second one is the one we will be using.
$ /usr/local/lsws/lsphp83/bin/lsphp -v
PHP 8.3.7 (litespeed) (built: Jun 3 2024 05:28:43)
Copyright (c) The PHP Group
Zend Engine v4.3.7, Copyright (c) Zend Technologies
You can check the list of enabled PHP modules.
$ /usr/local/lsws/lsphp83/bin/php --modules
[PHP Modules]
bcmath
calendar
Core
ctype
curl
date
dom
exif
FFI
fileinfo
filter
ftp
gd
gettext
gmp
hash
iconv
imap
intl
json
ldap
libxml
mbstring
mysqli
mysqlnd
openssl
pcre
PDO
pdo_mysql
pdo_pgsql
pdo_sqlite
Phar
posix
pspell
random
readline
Reflection
session
shmop
SimpleXML
soap
sockets
sodium
SPL
sqlite3
standard
sysvsem
sysvshm
tidy
tokenizer
xml
xmlreader
xmlwriter
xsl
zip
zlib
[Zend Modules]
Copy the php.ini-production
from the install folder to the /usr/local/lsws/lsphp83/lib
folder.
$ sudo cp php.ini-production /usr/local/lsws/lsphp83/lib/php.ini
We will configure OpenLiteSpeed to work with PHP later.
Open the php.ini
for editing.
$ sudo nano /usr/local/lsws/lsphp83/lib/php.ini
Find the variable include_path
and change its value as shown below.
$ ;;;;;;;;;;;;;;;;;;;;;;;;;
; Paths and Directories ;
;;;;;;;;;;;;;;;;;;;;;;;;;
; UNIX: "/path1:/path2"
include_path = "/usr/local/lsws/lsphp83/lib/php"
Once you are finished, save the file by pressing Ctrl + X and entering Y when prompted.
Step 5 – Configure MySQL
Log in to the MySQL shell.
$ sudo mysql
Create a test database. Replace testdb
with the appropriate database name of your choice.
mysql> CREATE DATABASE testdb;
Create a test user. Replace testuser
with an appropriate username. Replace Your_Password123
with a strong password.
mysql> CREATE USER 'testuser'@'localhost' IDENTIFIED BY 'Your_Password123';
Grant all privileges on the database to the user.
mysql> GRANT ALL PRIVILEGES ON testdb.* TO 'testuser'@'localhost';
Flush user privileges.
mysql> FLUSH PRIVILEGES;
Exit the MySQL shell.
mysql> exit
Step 6 – Configure OpenLiteSpeed
Switch the HTTP port back to 80
Let us change the default HTTP port to 80. Log in to your administration panel at http://<YOURSERVERIP>:7080
with the credentials you just created.
Visit the Listeners section from the left. You will see the default listeners with port 8080
.
Click the View button to see the detailed configuration. On the next page under Listener Default > General Page, click on the Edit icon and change the port from 8080
to 80
.
Click Save and restart the server by clicking the Graceful restart button.
Open the URL http://<YOURSERVERIP>
in your browser and you should get the following page.
Step 7 – Configure PHP
In this step, we need to associate our copy of PHP 8.3 with the server.
Click on the Server Configuration section on the left and then on the tab External App. You will see an existing LiteSpeed App for PHP. We will make some edits to it.
Click on the Edit button to edit the PHP app.
Next, match the configuration as shown below. Leave all the other fields blank.
Name: lsphp
Address: uds://tmp/lshttpd/lsphp.sock
Max Connections: 35
Environment: PHP_LSAPI_MAX_REQUESTS=500
PHP_LSAPI_CHILDREN=35
LSAPI_AVOID_FORK=200M
Initial Request Timeout (secs): 60
Retry Timeout : 0
Persistent Connection: Yes
Response Buffering: no
Start By Server: Yes(Through CGI Daemon)
Command: lsphp83/bin/lsphp
Back Log: 100
Instances: 1
Priority: 0
Memory Soft Limit (bytes): 2047M
Memory Hard Limit (bytes): 2047M
Process Soft Limit: 1400
Process Hard Limit: 1500
Click Save when finished.
Now that we have created our own PHP 8.3 app, we must tell the server to start using it. Since we edited the default listing, it is already configured. Restart the server by clicking on the Graceful restart button.
To test whether your PHP has been switched correctly, visit http://<YOURSERVERIP>/phpinfo.php
in your browser.
Restart PHP
On OpenLiteSpeed, if you edit php.ini or install a new PHP module, restarting the server won’t show the changes. You will need to restart the PHP process for that. First, you will need to locate the process IDs for the lsphp
process.
$ ps aux | grep lsphp
nobody 120093 0.0 0.8 123772 32920 ? S 06:35 0:00 lsphp
nobody 120111 0.0 0.4 123772 18980 ? Ss 06:38 0:00 lsphp
navjot 120139 0.0 0.0 6544 2304 pts/0 S+ 06:44 0:00 grep --color=auto lsphp
Manually kill the lsphp
processes.
$ sudo kill -9 120093
$ sudo kill -9 120111
Restart the Server.
$ sudo systemctl restart lsws
Step 8 – Create VirtualHost
First, we need to create directories for our virtual host.
$ sudo mkdir /usr/local/lsws/example.com/{html,logs} -p
The html
directory will hold the public files and the logs
directory will contain server logs.
Next, open the Admin console, access the Virtual Hosts section from the left, and click the Add button.
Fill in the values as specified
Virtual Host Name: example.com
Virtual Host Root: $SERVER_ROOT/example.com/
Config File: $SERVER_ROOT/conf/vhosts/$VH_NAME/vhconf.conf
Follow Symbolic Link: Yes
Enable Scripts/ExtApps: Yes
Restrained: Yes
External App Set UID Mode: Server UID
Click on the Save button when finished. You will get the following error because the configuration file doesn’t exist as of now. Click on the link to create the configuration file.
Click the Save button again to finish creating the Virtual Host.
Once the virtual host is created, go to Virtual Hosts -> Choose Virtual Host(example.com) -> General and modify the configuration as given.
Document Root: $VH_ROOT/html/
Domain Name: example.com
Enable GZIP Compression: Yes
Enable Brotli Compression: Yes
Click the Save button when finished. Next, we need to set up index files. Click the edit button against Index files below the General Section. Set the following options.
Use Server Index Files: No
Index files: index.php, index.html, index.htm
Auto Index: No
Click Save when done. Next, we need to choose Log files. Go to the Log section, click Edit against Virtual Host Log, and fill in the following values. Leave other settings unchanged.
Use Server’s Log: Yes
File Name: $VH_ROOT/logs/error.log
Log Level: ERROR
Rolling Size (bytes): 10M
Keep Days: 30
Compress Archive: Not Set
You can choose the Log Level as DEBUG
if you are on a development machine.
Click Save and then click the plus sign in the Access Log section to add a new entry. Fill in the following values.
Log Control: Own Log File
File Name: $VH_ROOT/logs/access.log
Piped Logger: Not Set
Log Format: Not Set
Log Headers: Not Set
Rolling Size (bytes): 10M
Keep Days: 30
Compress Archive: Not Set
Bytes log: Not Set
Click Save when done. Next, we need to configure Access Control under the Security section. Set the following Values.
Allowed List: *
Denied List: Not set
Click Save when done. Next, we need to set the Script Handler Definition. Click the plus (+) sign to add a new definition. Set the following values.
Suffixes: php
Handler Type: LiteSpeed SAPI
Handler Name: [Server Level]: lsphp
Click Save when done. Next, we need to set Rewrite Control under the Rewrite section. Set the following values.
Enable Rewrite: Yes
Auto Load from .htaccess: Yes
Log Level: Not Set
Click Save when done. And at last, we need to set the Listeners. Go to the Listeners section and click on the View button against Default Listener. Then, click on the Add button against Virtual Host Mappings to add a new mapping and set the following values.
Virtual Host: example.com
Domains: example.com
Click Save when done. Now, click on the Graceful restart button to apply all the changes above and restart the server.
Step 9 – Install SSL
Setting up SSL in OpenLiteSpeed requires us to set up two certificates. A self-signed certificate for the overall server and a Let’s Encrypt site-specific server.
The administration panel already comes with a self-signed certificate pre-installed which is available in the /usr/local/lsws/admin/conf
directory.
Let us create the Self Signed Certificate for the overall server first.
$ cd ~
$ openssl req -x509 -days 365 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes
You will get a similar output.
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:example.com
Email Address []:[email protected]
You can press enter through all the fields and leave them empty. Fill in your domain for the Common name and your email address.
Create the directory for the self-signed certificates.
$ sudo mkdir /usr/local/lsws/certs
Copy the certificate to the /usr/local/lsws/certs
directory.
$ sudo mv *.pem /usr/local/lsws/certs
We need to install Certbot to generate free SSL certificates offered by Let’s Encrypt.
You can either install Certbot using Debian’s repository or grab the latest version using the Snapd tool. We will be using the Snapd version. Ubuntu 24.04 comes comes with Snapd pre-installed.
Run the following commands to ensure that your version of Snapd is up to date.
$ sudo snap install core
$ sudo snap refresh core
Issue the following command to install Certbot.
$ sudo snap install --classic certbot
Use the following command to ensure that the Certbot command can be run by creating a symbolic link to the /usr/bin
directory.
$ sudo ln -s /snap/bin/certbot /usr/bin/certbot
Verify the installation.
$ certbot --version
certbot 2.10.0
Run the following command to generate an SSL Certificate.
Obtain the SSL certificate. The webroot directory is set to the public HTML directory configured earlier.
$ sudo certbot certonly --webroot -w /usr/local/lsws/example.com/html/ --agree-tos --no-eff-email --staple-ocsp --preferred-challenges http -m [email protected] -d example.com
Generate a Diffie-Hellman group certificate.
$ sudo openssl dhparam -dsaparam -out /etc/ssl/certs/dhparam.pem 4096
Check the Certbot renewal scheduler service.
$ sudo systemctl list-timers
You will find snap.certbot.renew.service
as one of the services scheduled to run.
NEXT LEFT LAST PASSED UNIT ACTIVATES
Mon 2024-06-03 07:20:00 UTC 5min Mon 2024-06-03 07:10:02 UTC 4min 11s ago sysstat-collect.timer sysstat-collect.service
Mon 2024-06-03 08:29:00 UTC 1h 14min - - snap.certbot.renew.timer snap.certbot.renew.service
Mon 2024-06-03 08:50:32 UTC 1h 36min Mon 2024-06-03 07:04:04 UTC 10min ago fwupd-refresh.timer fwupd-refresh.service
To check whether the SSL renewal is working fine, do a dry run of the process.
$ sudo certbot renew --dry-run
If you see no errors, you are all set. Your certificate will renew automatically.
Now open the Admin console, go to Listeners >> Add New Listener, and add the following values.
Listener Name: SSL IP Address: ANY IPv4 Port: 443 Secure: Yes
Virtual Host: example.com
Domains: example.com
Click Save when done. Next, go to the Virtual Host Mappings section under the SSL Listener by clicking on SSL, clicking on the Add button, and filling in the following values.
Click Save when done. Next, go to Listeners >> SSL Listener >> SSL Tab >>SSL Private Key & Certificate (Edit button) and fill in the following values for the self-signed certificate we created before.
Private Key File: $SERVER_ROOT/certs/key.pem
Certificate File: $SERVER_ROOT/certs/cert.pem
Chained Certificate: Yes
Click Save when done. Next, go to Listeners >> SSL Listener >> SSL Tab >> SSL Protocol (Edit button) and fill in the following values for the SSL protocol and cipher details.
Protocol Version: TLS v1.2 TLS v1.3
Ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305
Enable ECDH Key Exchange: Yes
Enable DH Key Exchange: Yes
DH Parameter: /etc/ssl/certs/dhparam.pem
Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> SSL Private Key & Certificate (Edit button) and fill in the following values with the Let’s Encrypt Certificate.
Private Key File: /etc/letsencrypt/live/example.com/privkey.pem
Certificate File: /etc/letsencrypt/live/example.com/fullchain.pem
Chained Certificate: Yes
Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> OCSP Stapling (Edit button) and fill in the following values to enable OCSP Stapling.
Enable OCSP Stapling: Yes
OCSP Response Max Age(Secs): 300
OCSP Responder: http://r3.o.lencr.org
Click Save when done. Next, go to Virtual Hosts >> example.com >> SSL Tab >> Security (Edit button) and fill in the following values to enable HTTP3/QUIC protocol.
ALPN: Enable HTTP/2 and HTTP/3
Enable HTTP3/QUIC: Yes
We don’t need to enable other options because they are on by default.
Click Save when finished.
Restart the server by clicking on the Graceful restart button.
Step 10 – Test Site
Create a Test file in your html
directory.
$ sudo nano /usr/local/lsws/example.com/html/index.php
Paste the following code in the Nano editor.
<html>
<head>
<h2>OpenLiteSpeed Server Install Test</h2>
</head>
<body>
<?php echo '<p>Hello,</p>';
// Define PHP variables for the MySQL connection.
$servername = "localhost";
$username = "testuser";
$password = "Your_Password123";
// Create a MySQL connection.
$conn = mysqli_connect($servername, $username, $password);
// Report if the connection fails or is successful.
if (!$conn) {
exit('<p>Your connection has failed.<p>' . mysqli_connect_error());
}
echo '<p>You have connected successfully.</p>';
?>
</body>
</html>
Save the file by pressing Ctrl + X and entering Y when prompted. Open the URL https://example.com
in a browser and you should see the following page.
The test site is fully functional. You can start using the server to serve dynamic PHP websites and applications.
Conclusion
This concludes our tutorial on installing LOMP Stack (OpenLiteSpeed, MySQL, and PHP) on a Ubuntu 24.04 server. If you have any questions, post them in the comments below.
Đăng ký liền tay Nhận Ngay Bài Mới
Subscribe ngay
Cám ơn bạn đã đăng ký !
Lỗi đăng ký !
Add Comment