Include or exclude domains from AutoSSL in cPanel

AutoSSL issues and renews free SSL certificates for every domain on your cPanel account. Sometimes you need to leave a name out, for example a subdomain that points to an external service or a domain whose DNS is not with MdmHost yet. Excluding it removes noisy failures and lets the rest of the certificate renew cleanly.

Before you start

• Access to cPanel.
• Know how AutoSSL works in general: see AutoSSL setup in cPanel.

When to exclude a domain

• The domain or subdomain points to another server (for example shop.example.com on a hosted shop platform or mail.example.com at an external mail provider).
• The domain is parked and its DNS is not set up yet.
• You installed a paid certificate for that name and do not want AutoSSL to replace it. AutoSSL normally leaves valid paid certificates alone, but excluding makes it explicit.

Exclude or include domains

1. Open cPanel → Security → SSL/TLS Status.
2. The list shows each domain with its certificate status: a green lock (valid AutoSSL), yellow (expiring or paid) or red (no valid certificate).
3. Tick the domains you want to change.
4. Click Exclude Domains from AutoSSL to remove them, or Include Domains during AutoSSL to add them back.

The excluded names show AutoSSL will not attempt to secure this domain.

Run AutoSSL now

On the same page, click Run AutoSSL. The check takes a minute or two; reload the page to see the new status. Without this, AutoSSL runs automatically once a day.

Check the result

• Open the site with https:// in a private window: the browser should show a padlock.
• In SSL/TLS Status, hover over a red icon to read why validation failed.

Troubleshooting

• DNS DCV failed / HTTP DCV failed: the domain does not resolve to your MdmHost server. Fix its nameservers or A record, or exclude it.
• Rate limit reached: too many attempts in a short time; wait and run again later.
• Blocked by .htaccess: a rule redirecting or blocking /.well-known/ stops validation. See AutoSSL not working.

Next steps

• Fix AutoSSL errors
• Generate a CSR for a paid certificate
• Force HTTPS