Manage service SSL certificates in WHM (Exim, Dovecot, FTP)

Websites are not the only things on a cPanel server that use SSL. WHM, cPanel, the mail server (Exim), the IMAP and POP3 server (Dovecot) and the FTP server each present a certificate. When one is wrong, mail apps and FTP clients show warnings even though websites look fine. This guide explains how to see and fix those certificates in WHM.

Before you start

• Root access to WHM on a cPanel server running on a Linux VPS.
• A valid hostname with a trusted certificate. See secure the WHM hostname with a free SSL certificate.
• If you plan to install your own certificate, its certificate file, private key and CA bundle.

Open Manage Service SSL Certificates

In WHM, go to Home » Service Configuration » Manage Service SSL Certificates.

The page lists each service with the certificate it currently uses:

• cPanel/WHM/Webmail Service (also used by the web-based calendar and contacts services);
• Exim (SMTP) Server;
• Dovecot Mail Server (IMAP and POP3);
• FTP Server.

For each one you see the domain names it covers, the issuer and the expiry date.

Understand what "good" looks like

On a healthy server, every service shows:

• a certificate issued for the server hostname, such as server.example.com;
• a public certificate authority as the issuer, not "self-signed";
• an expiry date in the future.

That is why mail clients should connect to the hostname, not to a customer's domain. The service certificate only covers the hostname unless you install something else.

Reset a service to the default certificate

If a service shows a self-signed, expired or wrong certificate, the simplest fix is to reset it. cPanel then uses a self-signed certificate briefly and AutoSSL replaces it with a trusted one for the hostname.

1. Find the service in the list.
2. Click Reset Certificate.
3. Confirm.

Then ask cPanel to check and fix certificates straight away:

/usr/local/cpanel/bin/checkallsslcerts

Install your own certificate on a service

If you bought a certificate for the hostname, or want all services to use a specific one:

1. Click Browse Certificates next to the service and pick one already on the server, or paste the certificate, private key and CA bundle into the fields.
2. Tick Apply certificate to another service if you want to reuse it elsewhere.
3. Click Install.

The certificate must cover the name clients connect to. Installing a certificate for example.com on Exim does not help a client that connects to server.example.com.

Fix mail client certificate warnings

The most common report is "the certificate doesn't match" in Outlook, Thunderbird or a phone mail app. The cause is nearly always the server name in the app.

• Incoming and outgoing server: set both to the hostname, server.example.com, not mail.example.com.
• Ports: IMAP 993 (SSL/TLS), POP3 995 (SSL/TLS), SMTP 465 (SSL/TLS) or 587 (STARTTLS).
• Username: the full email address.

If customers want to use their own domain as the mail server name, each domain needs its own certificate on the mail services. cPanel can serve per-domain mail certificates through SNI when AutoSSL covers the mail. subdomain, but older mail clients may not support SNI. Pointing everyone at the hostname is the safe default.

Check it works

Test each service from your computer:

openssl s_client -connect server.example.com:993 -servername server.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -enddate
openssl s_client -connect server.example.com:465 -servername server.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -enddate
openssl s_client -connect server.example.com:587 -starttls smtp </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -enddate

Each should show your hostname, a public issuer and a future date.

Troubleshooting

• Exim still self-signed after reset: AutoSSL could not validate the hostname. Check its A record and that port 80 is open, then run checkallsslcerts again.
• Only one service is wrong: it was pinned to an older certificate. Reset that service alone.
• Certificate expired on Dovecot but fine on WHM: the service did not reload. Restart it from Home » Restart Services » Mail Server (Dovecot).
• Phone mail app still warns: the app is set to a customer domain. Change the server name to the hostname.

Next steps

• Change the server name first if needed: change the server hostname in WHM.
• Settings to give your users: cPanel email client settings.
• Secure customer websites: set up AutoSSL in cPanel.