How to set up AutoSSL in cPanel & WHM

AutoSSL issues free, domain-validated certificates for every domain on your cPanel server and renews them before they expire. Once it is set up, new accounts and domains get HTTPS without anyone touching a certificate. This guide shows how to turn it on in WHM, run it, and check that it is working.

Before you start

• Root access to WHM.
• Domains that point at your server. AutoSSL proves control of each domain over HTTP or DNS, so each name must resolve to the VPS IP (or use DNS hosted on the server).
• Port 80 and 443 open in your firewall.

Choose the provider

1. In WHM, open SSL/TLS » Manage AutoSSL.
2. On the Providers tab, select Let's Encrypt.
3. Read and accept the Let's Encrypt terms of service when asked.
4. Click Save.

Current cPanel versions use Let's Encrypt as the AutoSSL provider. Older releases also offered a cPanel-branded provider powered by Sectigo; cPanel has since moved servers to Let's Encrypt, so check the Providers tab on your version to see what is offered. The Disabled option turns AutoSSL off.

Let's Encrypt can also issue wildcard certificates when the server can complete DNS validation, which needs the domain's DNS to be hosted on the server.

Set the options

Open the Options tab. Review:

• Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates: useful if old, expired purchased certificates are still installed. Leave it off if you have paid certificates you want to keep.
• Notifications: choose which AutoSSL events email the server contact and the account users. At least keep failure notices on for root.

Click Save.

Choose which users get AutoSSL

On the Manage Users tab, every cPanel account is listed. AutoSSL is normally on for all of them through their feature list. You can:

• Enable AutoSSL or Disable AutoSSL for a single user.
• Click Check next to a user to run AutoSSL just for that account.

Users can also run a check themselves in cPanel » Security » SSL/TLS Status with Run AutoSSL.

Run AutoSSL for all users

AutoSSL runs on a schedule, but after first setup you can start it now. On the Providers tab, click Run AutoSSL For All Users.

From SSH, the same job is:

/usr/local/cpanel/bin/autossl_check --all

This can take a while on servers with many domains, as each one is validated in turn.

Read the logs

The Logs tab lists each run. Open one to see each domain and whether it was secured, skipped or failed, with the reason. The same logs are stored on disk:

ls -lt /var/cpanel/logs/autossl/ | head

cPanel keeps these logs for about 30 days. A failure line names the domain and the validation error, which tells you what to fix.

Check it works

• In cPanel » Security » SSL/TLS Status, each domain should show a valid AutoSSL certificate and its expiry date.
• From any computer, check the live certificate:

  echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -dates

The issuer should be Let's Encrypt, and notAfter should be in the future.

Keep certificates renewing

AutoSSL renews certificates automatically shortly before they expire. Renewal keeps working as long as:

• The domain still points at the server and port 80 stays reachable.
• Nothing redirects or blocks the /.well-known/ validation path.
• The user's AutoSSL feature stays enabled.

If a domain moves to another host, remove it from the account, or AutoSSL will keep reporting failures for it.

Troubleshooting

• Domain shows "DCV failed": the domain does not resolve to this server or the HTTP check was blocked. See fix AutoSSL not issuing certificates.
• www or mail subdomain not covered: that name has no DNS record. Add it in the Zone Editor, then run AutoSSL for that user again.
• Paid certificate replaced: the option to replace non-AutoSSL certificates is on. Turn it off and reinstall your certificate.
• No runs in the Logs tab: the provider may be set to Disabled. Pick Let's Encrypt and save.

Next steps

• Send visitors to HTTPS: force HTTPS for a domain in cPanel.
• Secure the server's own hostname: WHM hostname SSL certificate.
• Fix stubborn domains: AutoSSL troubleshooting.