# cPanel SSL: AutoSSL and installing a purchased certificate

> Secure a cPanel site with free AutoSSL (Let's Encrypt) or a purchased certificate: check SSL/TLS Status, fix DCV problems, install a cert, force HTTPS.

Source: https://ssl.sh/guides/cpanel-ssl/
Last updated: 2026-11-10

cPanel's AutoSSL issues and renews a free certificate (Let's Encrypt by default) for every domain on the account that passes validation. A purchased certificate goes in under **SSL/TLS → Manage SSL sites**, and **Force HTTPS Redirect** sends HTTP to HTTPS.

Steps apply to current cPanel & WHM releases as of November 2026, with menu names from the cPanel documentation.

## Prerequisites

AutoSSL validates domains over the internet, so DNS must point at the server.

- A cPanel account; for provider settings, WHM root access (or ask your host).
- `A` records for each domain and `www` pointing at the server, for example `203.0.113.10`.
- No CDN proxy in front during validation, or DNS hosted on the server so DNS-based validation can run.
- For a purchased certificate: the certificate file, the CA bundle and the private key generated for it.

## Step 1: Make sure AutoSSL is enabled (WHM)

In WHM go to **SSL/TLS → Manage AutoSSL**. On the **Providers** tab select **Let's Encrypt** (the default) rather than **Disabled**, and accept the terms if prompted. On **Manage Users**, confirm AutoSSL is enabled for the account. To run it immediately for everyone from a root shell:

```bash
/usr/local/cpanel/bin/autossl_check --all
```

## Step 2: Check coverage in cPanel

In cPanel open **Security → SSL/TLS Status**. Filter by **Unsecured** and **Has AutoSSL Problems**; each problem row explains why a domain could not be validated. Exclude domains you do not need (for example unused subdomains) so they do not block or clutter the run.

## Step 3 (purchased certificates): Install the certificate

Generate the CSR in cPanel (**SSL/TLS → Certificate Signing Requests**) or with the [CSR generator](https://ssl.sh/tools/csr-generator/), buy the certificate, then open **Security → SSL/TLS → Manage SSL sites**. Select the domain, paste the certificate (CRT), private key (KEY) and CA bundle (CABUNDLE), and click **Install Certificate**. Always paste the CA bundle; see [install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/).

## Step 4: Force HTTPS

In cPanel open **Domains** and switch on **Force HTTPS Redirect** for each domain once its certificate is valid. If you prefer `.htaccess`, use the rule from [redirect HTTP to HTTPS](https://ssl.sh/guides/redirect-http-to-https/), and do not add a second redirect on top of the toggle.

## Verify

Each domain should present a valid certificate that includes its `www` name, and HTTP should redirect to HTTPS. Check each one with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal:

```bash
curl ssl.sh/example.com
curl ssl.sh/www.example.com
```

The issuer should be Let's Encrypt (AutoSSL) or your CA, the chain complete, and the expiry date in the future.

## Automatic renewal

AutoSSL certificates renew without action: AutoSSL runs every night during cPanel's update process and replaces certificates before they expire, as long as validation still succeeds. What breaks it is DNS moving away, a CDN proxy, or rewrite rules that block `/.well-known/`. Set the notification level in WHM **Manage AutoSSL → Options** so problems reach you, review logs in `/var/cpanel/logs/autossl`, and add the domains to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development). Purchased certificates are not renewed by AutoSSL; with public lifetimes capped at 200 days (100 days from March 15, 2027), consider letting AutoSSL cover them instead.

## Troubleshooting

- **HTTP DCV failed / content did not match**: an `.htaccess` redirect or a security plugin intercepts `/.well-known/acme-challenge/`; exclude that path.
- **Domain does not resolve to this server**: DNS points to a CDN or old host; fix the record or use DNS-based validation.
- **CAA record prevents issuance**: see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/).
- **Too many certificates for the domain**: repeated reissues hit Let's Encrypt limits; see [Let's Encrypt rate limits](https://ssl.sh/errors/lets-encrypt-rate-limit/).
- **Padlock missing after HTTPS works**: the page loads HTTP resources; see [mixed content warning](https://ssl.sh/errors/mixed-content-warning/).