Every MdmHost server issues free SSL certificates automatically through AutoSSL. As a reseller you do not need to buy certificates for basic HTTPS. Your job is to make sure the feature is available in your packages and to fix domains that fail validation, usually because DNS points elsewhere.
Before you start
- WHM access on your reseller plan.
- The customer's domain must point to the server (A record) for validation to succeed.
How AutoSSL works
- The server checks every cPanel account a few times a day.
- For each domain, subdomain and alias that resolves to the server, it requests a domain-validated certificate.
- Certificates are installed and renewed automatically before they expire, usually around 30 days before.
- Domains that fail validation are retried on the next run.
The provider and server-wide settings are managed by MdmHost. Server-side details are in the AutoSSL setup guide.
Make AutoSSL available in your packages
- Go to WHM → Packages → Feature Manager (see Feature Manager).
- Edit the feature list used by your packages.
- Make sure AutoSSL and SSL/TLS Status are ticked.
- Click Save.
Warning: If you untick AutoSSL in a feature list, accounts on that list lose automatic certificates at the next renewal, and sites start showing browser warnings.
Check a customer's SSL status
- Open the customer's cPanel from List Accounts (see opening a customer cPanel).
- Go to cPanel → Security → SSL/TLS Status.
- Each domain shows a green padlock (valid), an orange icon (expiring or self-signed) or a red icon (failed).
- Click Run AutoSSL to request certificates immediately instead of waiting for the next run.
Fix failed domains
| Message | Cause and fix |
|---|---|
| DNS does not resolve / points to another IP | The domain or www is not pointed at the server. Fix the A record, wait for propagation, then run AutoSSL. |
| HTTP validation failed (403/404) | An .htaccess rule blocks /.well-known/. Allow that path. |
| Domain uses a proxy/CDN | Cloudflare in proxy mode can block validation. Use DNS-only temporarily or a Cloudflare origin certificate. |
| Rate limit reached | Too many requests for the same domain. Wait and AutoSSL retries automatically. |
For other errors see AutoSSL not working.
Exclude domains that should not get SSL
Unused subdomains such as cpcalendars or parked domains pointing elsewhere create noise. In SSL/TLS Status, select them and click Exclude from AutoSSL.
Force HTTPS
A certificate alone does not redirect visitors. Customers should enable Force HTTPS Redirect in cPanel → Domains → Domains (see forcing HTTPS).
Frequently asked questions
Can customers install paid SSL certificates?
Yes. They can install any certificate in cPanel → Security → SSL/TLS. AutoSSL will not replace a valid paid certificate.
Do wildcard certificates work with AutoSSL?
AutoSSL issues certificates for the exact names on the account, not wildcards. For a wildcard, install a purchased certificate.
Does AutoSSL cover mail and cPanel subdomains?
Yes. It includes mail., cpanel., webmail. and similar service subdomains when they resolve to the server, so email clients can connect securely with the domain name.
How long does a new account wait for SSL?
Usually within a few hours. Running AutoSSL from SSL/TLS Status makes it immediate if DNS is already correct.