Enable and Verify AutoSSL (Let’s Encrypt) for a cPanel Account

Desired outcome

The primary domain (e.g., example.com) and every configured subdomain serve HTTPS with a valid Let’s Encrypt certificate issued through cPanel’s AutoSSL feature. Browsers show a padlock with no mixed‑content warnings, and the certificate renews automatically before its 90‑day expiry.

Prerequisites

1. WHM root or reseller access – AutoSSL must be enabled globally and the Let’s Encrypt provider selected (WHM → Manage AutoSSL → Providers → Let’s Encrypt enabled).
2. cPanel account with the target domain already added – The domain and any subdomains must exist in the account’s Domains interface.
3. DNS resolves to the server – A/AAAA records for each domain point to the server’s public IP at issuance time.
4. Port 80 open for HTTP‑01 challenges – Firewall/CSF must allow inbound TCP 80 to the server.
5. No blocking rules for /.well-known/acme-challenge/ – Custom Apache includes, .htaccess deny rules, or Cloudflare “orange‑cloud” proxying will cause validation to fail.

Procedure

1. Log in to the cPanel account that owns the domain.
2. Open SSL/TLS Status (cPanel → Security → SSL/TLS Status).
3. Confirm the primary domain and each desired subdomain appear in the list. For every row, check the Include during AutoSSL checkbox.
4. Click Run AutoSSL. The request is queued; processing usually finishes in under two minutes.
5. When the queue completes, inspect each row:
   • Valid with a green lock → success.
   • Pending or Failed → click the View Log link for that domain to see the error detail.
6. For a successful domain, click the certificate link (the “Certificate” column) to view the issuer, validity dates, and SAN list.

Expected checks

• cPanel UI – SSL/TLS Status shows a green “Valid” badge for every domain; the Issuer column reads R3 (Let’s Encrypt) and Valid To is roughly 90 days forward.
• Browser verification – Visit https://example.com and each subdomain (e.g., https://blog.example.com). The padlock appears with no mixed‑content warnings.
• Command‑line TLS inspection (run from any host with openssl installed):

  openssl s_client -connect example.com:443 -servername example.com 

  The output should display the same certificate chain, expiry date, and issuer R3.
• HTTP header check (optional, requires curl):

  curl -I https://example.com

  Expect HTTP/2 200 and, if HSTS is enabled, a Strict-Transport-Security header.
• WHM AutoSSL logs – In WHM → Manage AutoSSL → Logs, the most recent run for the user should contain a line such as AutoSSL completed successfully or AutoSSL renewed.
• External SSL test – Run the domain through SSL Labs (or similar) to confirm full chain, TLS 1.2/1.3 support, and absence of known vulnerabilities.

Recovery options

<IfModule mod_rewrite.c>
  RewriteRule ^\.well-known/acme-challenge/ - [L]
</IfModule>

Version notes & limitations

• cPanel 110+ ships with Let’s Encrypt as the default AutoSSL provider. Versions prior to 90 defaulted to the cPanel (Sectigo) provider.
• The UI path SSL/TLS Status replaced the legacy SSL/TLS Wizard in cPanel 92.
• Let’s Encrypt via AutoSSL only supports the HTTP‑01 challenge. Wildcard certificates require DNS‑01; they are not issued unless a DNS plugin (e.g., Cloudflare, Route 53) is configured in WHM.
• AutoSSL runs nightly via a system cron. Successful renewal appears in WHM logs as AutoSSL renewed. If the nightly run shows errors, investigate the corresponding domain’s log in cPanel.
• Rate limits: 50 certificates per registered domain per week (Let’s Encrypt). Exceeding this blocks issuance for the remainder of the week.

Quick verification checklist

1. ✅ cPanel SSL/TLS Status – green “Valid” for all domains.
2. ✅ Issuer = R3, expiry ≈ 90 days out.
3. ✅ Browser padlock on https://example.com and each subdomain.
4. ✅ openssl s_client matches UI details.
5. ✅ WHM AutoSSL log shows recent successful run.
6. ✅ SSL Labs grade A or better.

Following these steps gives you a fully automated, Let’s Encrypt‑backed TLS setup for a cPanel account with minimal ongoing maintenance.