Enabling and Managing AutoSSL in cPanel/WHM for Automatic DV Certificate Provisioning

Desired outcome

You manage a cPanel/WHM server and every domain hosted on it needs a valid SSL certificate. You want to avoid manual CSR generation, yearly renewal reminders, and the risk of expired certificates affecting user trust. AutoSSL automates the entire lifecycle: it issues, installs, and renews free domain-validated (DV) certificates on a regular schedule, replacing expiring or missing certs without intervention.

Necessary prerequisites

• DNS resolution: Each domain must have correct A/AAAA records pointing to the server's IP address. AutoSSL cannot validate a domain that the server does not route.
• Port 80 reachability: The default HTTP domain-control validation (DCV) check requires that inbound traffic on port 80 reaches the server unfiltered. If a firewall, NAT, or ISP blocks port 80, issuance will fail.
• No interfering proxy/CDN: Services such as Cloudflare's Full SSL mode or Flexible SSL mode, or any forward proxy that terminates or inspects inbound HTTP requests, can block the DCV challenge.
• WHM access: You need root or reseller-level privileges to navigate to SSL/TLS > Manage AutoSSL and select or change the validation provider.

Focused procedure

1. Log in to WHM and go to SSL/TLS > Manage AutoSSL. The interface lists the available providers.
2. Select a validation provider. The cPanel/Sectigo provider is enabled by default and uses HTTP DCV. The Let's Encrypt plugin, when installed via WHM's Plugin Manager, offers an alternative HTTP DCV flow and is free of charge, but it also relies on port 80 reachability.
3. If you choose Let's Encrypt, ensure the plugin is active: WHM > Plugin Manager > Installed Plugins shows letsencrypt as enabled.
4. Click Enable AutoSSL to activate the selected provider for the entire server.
5. Per-user configuration: under Manage AutoSSL > Manage AutoSSL user settings, toggle AutoSSL on or off for individual cPanel accounts. You can also exclude domains that already hold paid OV/EV certificates so AutoSSL does not replace them on renewal boundaries.
6. Trigger the initial run: from WHM, click Run AutoSSL for all users, or run it per-user from the same screen. Alternatively, from cPanel, go to SSL/TLS Status > Run AutoSSL.

Concrete example: choosing between providers

Consider a server hosting several client websites, some of which are behind Cloudflare. The cPanel/Sectigo provider may fail on domains proxied through Cloudflare because the HTTP DCV request gets intercepted. Switching the provider to Let's Encrypt for those specific users, or temporarily disabling Cloudflare's proxy (DNS-only mode) during the first issuance, often resolves the failure. After the certificate is installed, you can re-enable Cloudflare proxying; the certificate continues to renew automatically as long as the DCV challenge remains reachable.

Expected checks

After AutoSSL runs, perform these verification steps:

• In WHM Manage AutoSSL, open the Logs tab. A successful run shows DCV passed and Certificate installed with no error codes.
• In cPanel SSL/TLS Status, the domain should display a green padlock and list AutoSSL as the issuer. The expiry date should be approximately 90 days from the issuance time.
• Run a diagnostic curl request from any machine that can reach the server over HTTPS:

  curl -vI https://yourdomain.com

• Examine the output for the issuer line (e.g., Issuer: C=US, O=cPanel, Inc., CN=Sectigo RSA Domain Validation Secure Server CA or Issuer: C=US, O=Let's Encrypt, Authority X3) and the not before/not after dates. The certificate must be valid and issued by the AutoSSL provider you selected.

Recovery and rollback options

1. If AutoSSL fails, revisit the WHM logs. Common causes include DNS misconfiguration, port-80 blocks, or DCV challenges answered by a proxy that returns an unexpected status code.
2. Fix the root cause: correct the DNS A record, open port 80 inbound, or temporarily set the domain to DNS-only in your CDN while the first issuance completes.
3. Rerun AutoSSL from WHM Run AutoSSL for all users or the per-user option.
4. To manually revert to a previously installed certificate, go to cPanel SSL/TLS > Certificates and install the desired .crt and .key pair. A manually installed certificate takes precedence over AutoSSL and will not be overwritten unless you re-enable AutoSSL for that domain or remove the manual installation.

Limitations to keep in mind

• Wildcard certificates are not included with the default AutoSSL provider; coverage is limited to the exact domain and commonly resolving subdomains (e.g., www, mail, webmail).
• Rate limits from the certificate authority (especially Let's Encrypt's 5-certificate-per-domain-per-week limit) can throttle repeated failed runs. Resolve the underlying DCV issue before retrying to avoid hitting the limit.
• AutoSSL will replace existing certificates as they approach expiry. If you have paid OV/EV certificates installed, exclude those domains from AutoSSL or they will be downgraded to free DV.
• Feature paths and available providers vary across cPanel/WHM versions and license tiers. Always verify the UI matches your installed version.

AutoSSL removes the operational overhead of manual certificate management for DV domains. By ensuring DNS resolves correctly, port 80 is reachable, and the chosen validation provider aligns with your network topology, you can rely on automatic issuance and renewal with minimal day-to-day attention.