AutoSSL issues and renews free domain-validated certificates for every cPanel account on a server. As a server administrator you choose the certificate authority behind it. This guide compares the WHM AutoSSL providers, Let's Encrypt and Sectigo, and shows how to configure them. It applies to your own cPanel/WHM VPS or dedicated server; on MdmHost shared and reseller hosting AutoSSL is already managed for you.
Before you start
- Root access to WHM.
- Domains pointing to the server, because validation happens over HTTP or DNS.
Let's Encrypt vs Sectigo in AutoSSL
| Let's Encrypt | Sectigo (cPanel) | |
|---|---|---|
| Validity | 90 days, renewed early | Up to the current CA/B Forum maximum |
| Rate limits | Public limits per registered domain and per account | No public per-domain limits for cPanel AutoSSL |
| Wildcards in AutoSSL | Supported with DNS validation on the server's DNS | Not issued by AutoSSL |
| Speed of issuance | Very fast | Can be slower, queued |
| Plugin | Installed as an AutoSSL provider plugin | Built in |
Let's Encrypt is usually the better default for speed. Large servers with many subdomains under one registered domain can hit Let's Encrypt rate limits, where Sectigo can help.
Install the Let's Encrypt provider
On recent cPanel versions the Let's Encrypt provider is available by default. If it is missing, install it as root over SSH:
/usr/local/cpanel/scripts/install_lets_encrypt_autossl_providerChoose the AutoSSL provider
- Go to WHM → SSL/TLS → Manage AutoSSL.
- On the Providers tab select Let's Encrypt or cPanel (powered by Sectigo).
- For Let's Encrypt, accept the terms of service.
- Click Save.
Existing certificates stay installed. AutoSSL replaces them with the new provider's certificates as they approach expiry.
Set AutoSSL options
On the Options tab you control:
- Whether AutoSSL may replace certificates issued by other CAs that are invalid or expiring.
- Notifications to administrators and users about failures and successful renewals.
Use the Manage Users tab to enable or disable AutoSSL per account, or manage it through feature lists for packages.
Run AutoSSL manually
- Click Run AutoSSL For All Users on the Providers tab, or
- On Manage Users, click Check next to one account.
- Read the results in the Logs tab, which explains every domain that failed validation.
From the command line:
/usr/local/cpanel/bin/autossl_check --user=usernameWarning: Domains that do not resolve to the server fail validation on every run. With Let's Encrypt, repeated failures count against rate limits, so ask users to remove dead domains or exclude them.
Troubleshooting
- DCV failed: the domain points elsewhere, or a redirect or firewall blocks
/.well-known/acme-challenge. - Rate limit reached: wait for the limit window to pass, reduce failing domains, or switch to Sectigo.
- CAA record blocks issuance: the domain's CAA must allow
letsencrypt.orgorsectigo.comas appropriate.
Frequently asked questions
Is switching provider safe?
Yes. Valid certificates keep working, and new ones are issued at renewal time.
Can users choose their own provider?
No. The provider is server-wide. Users can still install their own certificates manually.
Why does AutoSSL cover mail and cpanel subdomains?
AutoSSL adds service subdomains such as mail, cpanel and webmail to each certificate when they resolve to the server.