Namecheap shared hosting SSL: free certificate, CAA records and troubleshooting

Namecheap shared hosting issues and installs a free SSL certificate for each domain and subdomain once the domain points to Namecheap's hosting nameservers. The free certificate covers the first year; after that you buy the renewal. Since July 11, 2026 SSL.com issues these certificates, which matters if you use CAA records.

A certificate stuck at "In progress" almost always means the domain is not pointed to the hosting server. Steps and screen names follow the Namecheap Knowledgebase and status page as of November 10, 2026.

How Namecheap issues certificates on shared hosting

The free certificate is part of the hosting offer. Namecheap's Knowledgebase says eligible shared hosting customers "receive 1 free SSL certificate for 1 year" for each domain or subdomain, up to 50 domains or subdomains per cPanel account, and that certificates are "automatically issued and installed whenever a domain or subdomain is added". Test certificates and certificates for domains you later removed still count toward the 50. After the first year Namecheap says to purchase the renewal SSL through the shopping cart.

Namecheap changed CA in 2026. Its provider-change article says that starting July 11, 2026, SSL certificates activated through your account are issued by "a new Certificate Authority—SSL.com". Existing Sectigo certificates keep working, and reissuing one does not change its CA. Namecheap's product list now shows SSL.com products such as Standard SSL (the old PositiveSSL), Standard Wildcard SSL, High Assurance SSL and EV SSL. When the free year ends, you can renew from your Namecheap account or buy a Namecheap SSL certificate; for a single site, a domain-validated Standard SSL covers the same names as the free one.

AutoSSL, which many cPanel hosts use, is a different thing here: Namecheap's AutoSSL article describes it as a WHM feature on its VPS and dedicated plans, not shared hosting.

Point your domain to Namecheap hosting

The free certificate requires the domain to be "properly pointed to our Namecheap hosting nameservers". For a domain registered at Namecheap, choose Namecheap Web Hosting DNS in the domain's nameserver settings, which sets:

dns1.namecheaphosting.com
dns2.namecheaphosting.com

If the domain stays on other nameservers (Cloudflare or your registrar's DNS), Namecheap's plugin article says both the domain and www must point to the hosting server with A or CNAME records; the server IP is in your hosting welcome email. Allow up to 24–48 hours for nameserver changes.

CAA records: ssl.com, and Sectigo for older certificates

If your domain has CAA records, they must allow the CA that issues your certificate. Namecheap's CAA article says to "Specify "ssl.com" in Value field for all SSL.com certificates", and lists comodoca.com, sectigo.com and trust-provider.com for Sectigo certificates. Its examples:

example.com.  IN  CAA  0 issue "ssl.com"
example.com.  IN  CAA  0 issuewild "ssl.com"

The provider-change article adds that if you already have Sectigo CAA records, add the SSL.com records as well before requesting an SSL.com certificate, or issuance will fail. Keep the Sectigo entries until every Sectigo certificate you still use has been replaced. Check the result with the CAA checker and see CAA record prevents issuance.

When the certificate is stuck

Open cPanel → Exclusive for Namecheap Customers → Namecheap SSL. The plugin has the tabs Ready for installation and Installed via Namecheap SSL, and uses these certificate statuses, as Namecheap words them:

• "In progress": "this means that an SSL is being activated, issued and installed".
• "Active": "this means that an SSL is issued by certificate authority and installed".
• "Expired".

Namecheap warns that if the domain is not pointed to the hosting server, "the SSL installation will not be completed, and the certificate will be stuck with the "In progress" status." The plugin normally needs about 25 minutes. To recover, fix DNS, then click Sync or Reconnect in the plugin, or Retry next to the certificate in your Namecheap account's SSL Certificates list. Namecheap's rule: "If the certificate is not issued within 25 minutes, please contact our Support Team for assistance."

If you use the cPanel-based SSL Manager instead, the statuses are Validating, Pending ("The SSL manager has activated your SSL, but the Certificate Authority hasn't validated it yet.") and Installed. Validation usually takes up to 15 minutes when the domain already points to cPanel, and up to 24 hours otherwise.

Status note, November 2026: Namecheap's status page reported the Namecheap SSL plugin in cPanel on shared hosting as temporarily unavailable from November 6, 2026, 16:30 UTC, with production testing scheduled for November 10 and a gradual rollout afterwards. Installed certificates, free Standard SSL provisioning and scheduled automatic reissues were not affected. The documented workarounds are to activate or reissue the certificate in your Namecheap account and install it manually in cPanel → SSL/TLS, or to use SSL Manager. Check the status page for the current state.

Behind Cloudflare, Namecheap lists errors such as "525", "SSL Handshake Failed", "526" and "Invalid SSL certificate" when the origin certificate is missing or invalid; pause the proxy until the certificate is Active.

dig +short NS example.com
dig +short A example.com
dig +short CAA example.com

Force HTTPS

The Namecheap SSL plugin redirects HTTP to HTTPS by default. Namecheap: "HTTPs redirect is enabled by default and once an SSL is installed, a HTTP URL will be redirected to HTTPS." The Installed via Namecheap SSL tab has a per-domain HTTPS Redirect toggle and an HTTPS by default setting for automatically installed certificates; a redirect waiting for its certificate shows "Pending - HTTPS redirect will be enabled as soon as an SSL is installed". The redirect turns off for an expired certificate. For a certificate installed another way, Namecheap's .htaccess method in public_html:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L]

Namecheap's HSTS article lists the prerequisites before adding the header: a valid certificate with no errors, an HTTP-to-HTTPS redirect and no mixed content. The header itself is covered in enable HSTS.

Fix mixed content

Namecheap's answer to "my SSL is installed, why do I get Not secure" is mixed content. Its quick fix is to add this as the first line of the site's .htaccess:

Header set Content-Security-Policy "upgrade-insecure-requests" env=HTTPS

The lasting fix is to change http:// links to https:// or root-relative paths; for WordPress, Namecheap's guide also covers the site URLs under Settings → General and a database search-and-replace. The plugin article warns that some shopping carts (PrestaShop, Magento, OpenCart) can show insecure-content issues after the switch. Find the offenders with the mixed content scanner and read mixed content warning.

Can you upload your own certificate?

Yes. In cPanel → Security → SSL/TLS → Manage SSL sites, select the domain, paste the certificate, click Autofill by Certificate to fill the private key, add the CA bundle and click Install Certificate. Namecheap also installs a certificate from another provider for you if you send it with the full chain, and says "The SSL certificate installation itself is free of charge." SNI lets several certificates share the server's IP. Add the other CA to your CAA records too. Public certificates are capped at 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, so any manually installed certificate becomes a recurring task; see the cPanel SSL guide and free vs paid SSL before buying.

Verify

Once the plugin shows Active, the domain and www should present an SSL.com certificate (Sectigo for certificates activated before July 11, 2026), and HTTP should redirect to HTTPS. Check it from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The SSL checker shows the same issuer and names, plus the chain and expiry. The free offer covers one year, so put a reminder in your calendar for the paid renewal and add the domain to ssl.sh monitoring (in development).