How to secure the WHM hostname with a free SSL certificate

A fresh cPanel server uses a self-signed certificate for its hostname, so the browser shows a warning every time you open WHM on port 2087. cPanel can replace it with a free, trusted certificate through AutoSSL. This guide shows how to get that certificate issued and confirm every service uses it.

Before you start

• cPanel & WHM installed on a Linux VPS, and root access to WHM.
• A proper hostname such as server.example.com, set in Home » Networking Setup » Change Hostname. See change the server hostname in WHM.
• An A record for the hostname that points at the server IP, for example 203.0.113.10.
• Port 80 open inbound. AutoSSL validates domains over HTTP or DNS.

How hostname SSL works in cPanel

cPanel treats the hostname differently from customer websites. The hostname certificate covers WHM (2087), cPanel (2083), Webmail (2096) and the mail services. AutoSSL requests it automatically when:

• the current hostname certificate is self-signed, expired or for the wrong name; and
• the hostname resolves to this server.

The tool that triggers this check by hand is checkallsslcerts.

Step 1: Confirm DNS for the hostname

hostname -f
dig +short "$(hostname -f)"

The first line is the hostname. The second must be your server IP. If dig prints nothing or another IP, fix the A record and wait for it to propagate. AutoSSL cannot validate a name that points elsewhere.

Step 2: Make sure AutoSSL is enabled

1. In WHM, go to Home » SSL/TLS » Manage AutoSSL.
2. On the Providers tab, check that a provider is selected, such as Let's Encrypt or the cPanel (powered by Sectigo) provider.
3. Click Save if you made a change.

If you choose Let's Encrypt, WHM asks you to accept its terms of service. Read them before you agree.

Step 3: Run checkallsslcerts

Log in over SSH as root and run:

/usr/local/cpanel/bin/checkallsslcerts

The script checks each service certificate. If the hostname certificate is not trusted, it requests a new one through AutoSSL. The output reports each service and whether a new certificate was installed.

Wait a few minutes, then run it again. A good run reports that the certificates are valid and need no changes.

Step 4: Reload WHM

Close the browser tab and open WHM using the hostname, not the IP:

https://server.example.com:2087

The padlock should show a trusted certificate issued for server.example.com. If you open WHM by IP address, you will still get a warning, because certificates are issued for names, not IPs.

Check it works

From any machine with OpenSSL:

openssl s_client -connect server.example.com:2087 -servername server.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Check that:

• subject contains your hostname;
• issuer is a public certificate authority, not your own server;
• notAfter is in the future.

In WHM, Home » Service Configuration » Manage Service SSL Certificates should list the same certificate for cPanel, Exim, Dovecot and FTP.

Troubleshooting

• checkallsslcerts reports a DCV failure: domain validation failed. The A record points elsewhere, or port 80 is blocked. Check DNS and your firewall, then run it again.
• Still self-signed after a successful run: a service is pinned to an older certificate. Reset it in Manage Service SSL Certificates.
• Warning only when using the IP: expected. Always use the hostname in the address bar.
• Rate-limit errors from Let's Encrypt: too many attempts in a short time. Wait, fix the root cause, and try again later, or switch the AutoSSL provider.
• Hostname is the same as a website domain: the certificates collide. Change the hostname to a dedicated subdomain.

Next steps

• Fix mail client warnings: manage service SSL certificates in WHM.
• Secure customer sites too: set up AutoSSL in cPanel.
• Can't open WHM at all? See can't access WHM on port 2087.