Enabling and Managing AutoSSL in cPanel/WHM: Free Certificates That Renew Themselves

If you host more than a handful of domains on a cPanel server, manually generating CSRs, buying certificates, and reinstalling them every year is busywork that eventually gets forgotten — and an expired cert means browser warnings and lost trust. AutoSSL solves this by automatically issuing, installing, and renewing free domain-validated (DV) certificates for every hosted domain. This guide covers enabling it in WHM, controlling it per account, verifying the results, and recovering from the failures you are most likely to hit.

Note: menu names and the default provider vary between cPanel/WHM versions. The paths below reflect recent versions; confirm against your server's interface, and treat anything version-specific as worth a quick check before relying on it.

What AutoSSL actually does

AutoSSL is a WHM/cPanel feature that watches for domains with missing or expiring certificates and replaces them with free DV certificates from a chosen provider — typically Sectigo (the bundled default) or Let's Encrypt via a plugin. Validation is HTTP-based domain control validation (DCV): the provider fetches a token file from a well-known path on your domain, so DNS must resolve to your server and port 80 must answer. Certificates generally cover the domain, its www subdomain, and common service subdomains like mail and webmail. Wildcard coverage is not provided by default.

Prerequisites before you enable anything

• Root WHM access. Provider selection is a server-wide setting.
• DNS resolves to this server. Each domain's A record (and AAAA record, if present) must point at the cPanel server. A stale IPv6 record pointing elsewhere is a classic silent failure.
• Ports 80 and 443 reachable. HTTP DCV needs port 80 open even if you force HTTPS everywhere.
• No blocking redirect rules. .htaccess rules or a CDN/WAF that intercepts or redirects the /.well-known/ path will break validation.
• Understand the replacement policy. By default AutoSSL will not replace a valid paid or EV certificate. That is usually what you want — do not change it unless you intend to downgrade those certs.

Enabling AutoSSL in WHM

1. Log in to WHM as root and go to SSL/TLS > Manage AutoSSL.
2. Select your provider — Sectigo or Let's Encrypt — review the provider's terms and rate limits, and save.
3. Under the Manage Users (or similarly named) tab, confirm AutoSSL is enabled for the cPanel accounts you want covered. You can enable, disable, or force a run per account here.
4. Trigger an initial pass with Run AutoSSL For All Users, or run it for one account to test first. After the initial run, AutoSSL continues on its scheduled (typically nightly) runs and renews certificates before expiry automatically.

Individual cPanel users can also check their own domains from cPanel > SSL/TLS Status and request a re-run from there, which is useful for delegating troubleshooting.

Verifying the result

Do not assume the green banner in WHM means every domain passed. Check three places:

• cPanel > SSL/TLS Status for the account: each domain should show a padlock rather than a warning.
• From any external machine, run curl -Iv https://yourdomain.example and inspect the issuer (Sectigo or Let's Encrypt), the validity dates, and the SAN list. A DV cert from Let's Encrypt is typically valid for 90 days; AutoSSL renews well before expiry.
• The AutoSSL logs: WHM's AutoSSL log viewer, or on disk at /usr/local/cpanel/logs/autossl/ (requires root shell access), records per-domain DCV results and the exact reason for any failure.

When issuance fails: diagnosis and recovery

Failures almost always come down to DCV. Work through this order:

1. Check DNS. Confirm both A and AAAA records resolve to this server. Remove or fix stray IPv6 records.
2. Check the DCV path. From outside the server, request http://yourdomain.example/.well-known/ and confirm it is not redirected to HTTPS in a way that drops the token, blocked by .htaccess, or intercepted by a WAF.
3. Check proxies. Sites behind Cloudflare or similar proxies frequently fail HTTP DCV. Temporarily switch the record to DNS-only, issue the cert, then re-enable the proxy — or use a provider/configuration that supports alternate validation.
4. Mind rate limits. Let's Encrypt enforces issuance rate limits. Repeatedly forcing runs across many failing domains can get you throttled and delay everything. Fix the root cause first, then re-run for a single user.

Recovery is low-risk because a failed run changes nothing on the live site: fix the blocker, then re-run the per-user AutoSSL check from WHM's Manage AutoSSL users tab or the account's SSL/TLS Status page, and re-verify with the curl check above.

Limitations to plan around

AutoSSL issues DV certificates only — no OV/EV, and no wildcards by default. If a domain legitimately needs a paid EV cert, AutoSSL's default policy of not replacing valid non-AutoSSL certificates protects it, but verify that setting after any major cPanel upgrade. Finally, AutoSSL only covers domains whose DNS points at the server; domains hosted elsewhere or added before DNS cutover will fail until DNS is correct.