Does AutoSSL cover wildcard domains?

The Let's Encrypt AutoSSL provider supports wildcard domains according to the cPanel documentation; wildcard validation requires DNS, so the server must manage the domain's authoritative DNS.

Will AutoSSL replace a certificate I bought?

Only if the administrator enables the option that lets AutoSSL replace non-AutoSSL certificates, and then only when the purchased certificate is invalid or about to expire. cPanel advises enabling that option only if you understand the consequences.

Do I still need to renew certificates manually on cPanel?

Not for AutoSSL certificates; they renew automatically. Purchased certificates must be reissued and reinstalled before each expiry, and since March 15, 2026 public certificates last at most 200 days.

cPanel SSL: AutoSSL and installing a purchased certificate

cPanel's AutoSSL issues and renews a free certificate (Let's Encrypt by default) for every domain on the account that passes validation. A purchased certificate goes in under SSL/TLS → Manage SSL sites, and Force HTTPS Redirect sends HTTP to HTTPS.

Steps apply to current cPanel & WHM releases as of November 2026, with menu names from the cPanel documentation.

Prerequisites

AutoSSL validates domains over the internet, so DNS must point at the server.

A cPanel account; for provider settings, WHM root access (or ask your host).
A records for each domain and www pointing at the server, for example 203.0.113.10.
No CDN proxy in front during validation, or DNS hosted on the server so DNS-based validation can run.
For a purchased certificate: the certificate file, the CA bundle and the private key generated for it.

Step 1: Make sure AutoSSL is enabled (WHM)

In WHM go to SSL/TLS → Manage AutoSSL. On the Providers tab select Let's Encrypt (the default) rather than Disabled, and accept the terms if prompted. On Manage Users, confirm AutoSSL is enabled for the account. To run it immediately for everyone from a root shell:

/usr/local/cpanel/bin/autossl_check --all

Step 2: Check coverage in cPanel

In cPanel open Security → SSL/TLS Status. Filter by Unsecured and Has AutoSSL Problems; each problem row explains why a domain could not be validated. Exclude domains you do not need (for example unused subdomains) so they do not block or clutter the run.

Step 3 (purchased certificates): Install the certificate

Generate the CSR in cPanel (SSL/TLS → Certificate Signing Requests) or with the CSR generator, buy the certificate, then open Security → SSL/TLS → Manage SSL sites. Select the domain, paste the certificate (CRT), private key (KEY) and CA bundle (CABUNDLE), and click Install Certificate. Always paste the CA bundle; see install an intermediate certificate.

Step 4: Force HTTPS

In cPanel open Domains and switch on Force HTTPS Redirect for each domain once its certificate is valid. If you prefer .htaccess, use the rule from redirect HTTP to HTTPS, and do not add a second redirect on top of the toggle.

Verify

Each domain should present a valid certificate that includes its www name, and HTTP should redirect to HTTPS. Check each one with the SSL checker, or from any terminal:

curl ssl.sh/example.com
curl ssl.sh/www.example.com

The issuer should be Let's Encrypt (AutoSSL) or your CA, the chain complete, and the expiry date in the future.

Automatic renewal

AutoSSL certificates renew without action: AutoSSL runs every night during cPanel's update process and replaces certificates before they expire, as long as validation still succeeds. What breaks it is DNS moving away, a CDN proxy, or rewrite rules that block /.well-known/. Set the notification level in WHM Manage AutoSSL → Options so problems reach you, review logs in /var/cpanel/logs/autossl, and add the domains to ssl.sh monitoring (in development). Purchased certificates are not renewed by AutoSSL; with public lifetimes capped at 200 days (100 days from March 15, 2027), consider letting AutoSSL cover them instead.

Troubleshooting

HTTP DCV failed / content did not match: an .htaccess redirect or a security plugin intercepts /.well-known/acme-challenge/; exclude that path.
Domain does not resolve to this server: DNS points to a CDN or old host; fix the record or use DNS-based validation.
CAA record prevents issuance: see CAA record prevents issuance.
Too many certificates for the domain: repeated reissues hit Let's Encrypt limits; see Let's Encrypt rate limits.
Padlock missing after HTTPS works: the page loads HTTP resources; see mixed content warning.

How to set up SSL in cPanel with AutoSSL or a purchased certificate