Resellers and server administrators can install SSL certificates for any account from WHM, without logging in to each customer's cPanel. This is handy when a customer buys a paid certificate and sends you the files, or when you manage certificates for clients.
Before you start
- Access to WHM from MdmHost dashboard → Services → Login to WHM (reseller and master reseller plans).
- The certificate files from the CA: the certificate (
.crt) and the CA bundle (intermediate certificates). - The private key that matches the CSR. If the CSR was generated in the customer's cPanel, the key is already stored there and WHM can find it.
- The domain must belong to an account you control.
Open the installer
- In WHM open SSL/TLS → Install an SSL Certificate on a Domain.
- Paste the certificate, starting with
-----BEGIN CERTIFICATE-----, into the Certificate box.
Use autofill
Click Autofill by Certificate. WHM reads the domain from the certificate, looks for the matching private key on the server and fetches the CA bundle from the issuing CA where possible. Check each field:
| Field | What should be there |
|---|---|
| Domain | The domain from the certificate |
| IP Address | The account's IP; leave the default on shared IPs (SNI) |
| Private Key | The matching key, beginning -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- |
| Certificate Authority Bundle | The intermediate certificate(s) from the CA |
If autofill cannot find the key, paste it manually. If the CA bundle is empty, paste the intermediate certificates the CA sent, usually in a file called ca-bundle, intermediate.crt or similar.
Install
- Click Install.
- WHM confirms the installation and lists the domains covered and the expiry date.
The certificate is now active for the domain, and it also appears in the customer's cPanel → Security → SSL/TLS → Manage SSL sites.
Verify the installation
- Open
https://domainin a private window and inspect the certificate: issuer, names and expiry should match. - Run an external SSL checker to confirm the chain is complete. Missing intermediates break some browsers and mobile apps even when your desktop browser looks fine.
- Check WHM → SSL/TLS → Manage SSL Hosts to see all installed certificates across accounts.
Interaction with AutoSSL
AutoSSL does not replace a valid paid certificate. It may replace a certificate that is expired, self-signed or about to expire, if AutoSSL is enabled for that account. To keep a paid certificate in charge, renew it in time.
Troubleshooting
- "The certificate does not match the private key": the certificate was issued for a different CSR. Find the right key, or reissue with a new CSR.
- "The domain is not owned by any account": add the domain to an account first, or check for typos.
- Browser shows the old certificate: clear the browser cache or test from another device; some browsers cache certificates briefly.
- Chain incomplete warning: paste the full CA bundle, intermediates only, not the root.