A self-signed certificate is one your server signs itself instead of a trusted certificate authority. It encrypts traffic just like any other certificate, but browsers cannot verify who issued it, so they show a full-page warning. On public websites you should replace it with a trusted certificate; for some internal uses it is acceptable.
Before you start
- Open cPanel → Security → SSL/TLS Status to see which domains have a trusted certificate, a self-signed one or none.
- Remember that MdmHost provides trusted certificates for free with AutoSSL, so cost is never a reason to use self-signed certificates on a public site.
Why you might see one
- A new domain whose DNS does not point to the server yet; cPanel serves a self-signed or server certificate until AutoSSL can validate.
- AutoSSL failed for the domain (DNS, CAA records or a blocked validation path).
- Someone generated one manually in SSL/TLS and installed it.
When self-signed is acceptable
| Use | Acceptable? |
|---|---|
| Public website or shop | No, use AutoSSL or a paid certificate |
| Temporary test on a domain without public DNS | Yes, briefly |
| Behind Cloudflare in Full (non-strict) mode | Works, but Full (strict) with a trusted or Origin certificate is safer |
| Internal tools only you use | Possible, but a trusted certificate avoids training people to click through warnings |
Generate a self-signed certificate
- Open cPanel → Security → SSL/TLS.
- Under Certificates (CRT) click Generate, view, upload, or delete SSL certificates.
- Under Generate a New Certificate choose a key (or generate a new one), enter the domains and the address details.
- Click Generate.
- Install it from SSL/TLS → Manage SSL sites with Autofill by Certificate and Install Certificate.
Replace it with a trusted certificate
- Make sure the domain and its
wwwname point to your MdmHost server. - Open cPanel → Security → SSL/TLS Status, select the domain names and click Run AutoSSL.
- If AutoSSL leaves a manually installed self-signed certificate in place, remove it in SSL/TLS → Manage SSL sites (Uninstall) and run AutoSSL again.
- Reload the site in a private window and confirm the issuer is a public CA.
Don't teach users to click through
Asking customers or colleagues to "accept the risk" on a warning page makes them more likely to ignore a real attack later. If a site is meant to be reached by anyone other than you, give it a trusted certificate.
How to recognise a self-signed certificate
Click the warning's details or the certificate viewer in your browser. If Issued to and Issued by show the same name, or the issuer is your server's hostname rather than a known certificate authority, it is self-signed. Browsers usually report it as NET::ERR_CERT_AUTHORITY_INVALID or SEC_ERROR_UNKNOWN_ISSUER. The same error can also mean a paid certificate was installed without its CA bundle, so check the issuer before deciding which fix applies.
Troubleshooting
- AutoSSL keeps failing, so the self-signed one stays: read the AutoSSL log in SSL/TLS Status; fix DNS, CAA or
.htaccessrules blocking/.well-known/. - Warning shows the server's hostname: no certificate is installed for the domain at all; the server's default certificate is served instead.
- Mail apps warn about a self-signed certificate: use the server hostname from Connect Devices for mail settings.