LiteSpeed tech support had the answer: in a CyberPanel install, the vhost file is created with a context override that redirects requests to acme-challenge to a custom path. In my case, /usr/local/lsws/conf/vhosts/mydomain.com/vhost.conf contains these lines:
context /.well-known/acme-challenge {
location /usr/local/lsws/Example/html/.well-known/acme-challenge
Yes, it is hard-coded to go to the “lsws/Example” directory.
Once I changed the -w parameter in my acme.sh command, it was able to issue the certificate correctly:
sudo /root/.acme.sh/acme.sh --issue -d new.mydomain.com --cert-file /etc/letsencrypt/live/mydomain.com/cert.pem --key-file /etc/letsencrypt/live/mydomain.com/privkey.pem --fullchain-file /etc/letsencrypt/live/mydomain.com/fullchain.pem -w /usr/local/lsws/Example/html --server letsencrypt --force --debug