SSL certificates in cPanel

SSL/TLS certificates provide a secure HTTPS connection between a visitor’s browser and your website, encrypting the data that is sent.

This article is about shared hosting with cPanel. On your own cloud server, certbot obtains the certificate: Let's Encrypt certificate: certbot.

Why you need SSL

Benefits of HTTPS

1. Security
   • Encryption of data (passwords, payment information)
   • Protection against traffic interception (man-in-the-middle attacks)
   • Proof that the site is genuine
2. SEO
   • Google ranks HTTPS sites higher
   • Better visibility in search results
3. User trust
   • A padlock in the address bar
   • No “Not secure” warnings
   • Higher conversion rates
4. Requirements
   • Essential for e-commerce
   • Needed for modern APIs
   • Required for HTTP/2 and HTTP/3

Types of SSL certificate

By level of validation

By domain coverage

Single Domain

One domain (example.com)

Wildcard

The domain and all its subdomains (*.example.com)

Multi-Domain (SAN)

Several different domains in one certificate

Let's Encrypt (free SSL)

Let's Encrypt is a free certificate authority supported by cPanel.

Installing Let's Encrypt SSL

1. Log in to cPanel
2. In the SECURITY section, choose SSL/TLS Status
3. Find your domain in the list
4. If the status is “Not Secure”, click Run AutoSSL
5. Or tick the domain and click Run AutoSSL at the bottom
6. Wait for it to finish (usually 1–5 minutes)
7. The status changes to “Secure” (green padlock)

What AutoSSL covers

AutoSSL issues certificates for:

• The main domain (example.com)
• The www version (www.example.com)
• Subdomains
• The mail server (mail.example.com)
• cPanel (cpanel.example.com)
• Webmail (webmail.example.com)

Checking AutoSSL status

1. SSL/TLS Status
2. Look at the statuses:
   • Secure (green padlock) – a certificate is installed
   • Not Secure (red cross) – no certificate
   • Partially Secure (yellow triangle) – mixed content

Automatic renewal

AutoSSL automatically:

• Checks certificates every 24 hours
• Renews them 30 days before they expire
• Sends notifications about problems

To check:

1. Go to AutoSSL
2. Look at:
   • Last Run – the last run
   • Next Run – the next run
   • Status – the status

Fixing AutoSSL problems

Error: Domain control validation failed

Causes:

• DNS does not point to the server
• A firewall is blocking the check
• The site is password-protected

Solution:

1. Check the domain’s A record
2. Temporarily turn off password protection (.htaccess)
3. Make sure port 80 is open

Error: CAA records prevent issuance

A CAA (Certification Authority Authorization) record is blocking issuance.

Solution:

1. Go to Zone Editor
2. Find the CAA records
3. Add Let's Encrypt:

example.com CAA 0 issue "letsencrypt.org"
example.com CAA 0 issuewild "letsencrypt.org"

Some subdomains did not get a certificate

Causes:

• The subdomain has no A record
• The subdomain points to a different server
• The limit has been exceeded (100 subdomains per certificate)

Solution:

1. Check the DNS records
2. Create a separate certificate for the subdomain
3. Use a wildcard certificate

Installing your own SSL certificate

If you have a commercial SSL certificate:

Getting an SSL certificate

1. Buy one from a provider (Comodo, DigiCert, Sectigo and others)
2. Or get one from a corporate CA
3. Generate a CSR (Certificate Signing Request)

Generating a CSR in cPanel

1. Go to SSL/TLS
2. Choose Generate, view, or delete SSL certificate signing requests
3. Fill in the form:

Required fields:

• Key Size: 2048 bits (recommended) or 4096
• Domain(s): example.com, or *.example.com for a wildcard
• Common Name: the fully qualified domain name (FQDN)
• Email: your email address
• Company Name: the company name (for OV/EV)
• Company Division: the department
• City: the city
• State: the county or state
• Country: the country code (GB for the United Kingdom)

1. Click Generate
2. Copy the CSR (the -----BEGIN CERTIFICATE REQUEST----- block)
3. Send the CSR to the certificate authority

Installing an SSL certificate

Once you have the certificate from the CA:

1. Go to SSL/TLS
2. Choose Manage SSL sites
3. Select the domain
4. Paste the parts of the certificate:

Certificate (CRT):

-----BEGIN CERTIFICATE-----
MIIFazCCBFOgAwIBAgIRAIIQz7DSQ...
-----END CERTIFICATE-----

Private Key:

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAusI/V52eqLb...
-----END RSA PRIVATE KEY-----

Certificate Authority Bundle (CA Bundle):

-----BEGIN CERTIFICATE-----
MIIENjCCAx6gAwIBAgIBATANBgkq...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEFzCCAv+gAwIBAgIBADANBgkq...
-----END CERTIFICATE-----

1. Click Install Certificate
2. The certificate is activated

Automatic installation (AutoSSL)

Some certificates can be installed automatically:

1. Paste the certificate into Install and Manage SSL
2. cPanel detects the domain automatically
3. It fills in the fields for you
4. Click Install

Managing SSL certificates

Viewing installed certificates

1. SSL/TLS → Manage SSL sites
2. A list of all domains with SSL
3. Information shown:
   • Issuer
   • Expires (expiry date)
   • Domains Covered

Certificate details

1. SSL/TLS → Manage SSL sites
2. Click Browse Certificates
3. Select a certificate
4. Look at the details:
   • Subject (the owner)
   • Issuer
   • Valid From/To (validity period)
   • Serial Number
   • Signature Algorithm
   • Public Key

Removing an SSL certificate

1. Manage SSL sites
2. Find the domain
3. Click Uninstall
4. Confirm the removal

Redirecting HTTP to HTTPS

After installing SSL, set up an automatic redirect:

Method 1: .htaccess (recommended)

1. Open File Manager
2. Go to public_html
3. Edit .htaccess (or create a new one)
4. Add this to the top of the file:

# Redirect to HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Or for a specific domain
RewriteEngine On
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

Method 2: Using Redirects

1. Go to Domains → Redirects
2. Type: Permanent (301)
3. From: http://example.com
4. To: https://example.com
5. Tick Wild Card Redirect
6. Click Add

Method 3: WordPress

Add this to wp-config.php:

// Force HTTPS for the admin area
define('FORCE_SSL_ADMIN', true);

// Force HTTPS for the whole site
if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false)
    $_SERVER['HTTPS']='on';

Checking your SSL configuration

Online tools

1. SSL Labs Test: SSL Server Test
   • A grade from F to A+
   • Detailed analysis of the configuration
   • Vulnerability checks
2. Why No Padlock: Why No Padlock
   • Finds mixed content
3. SSL Checker: SSL Checker
   • Checks that the certificate is valid
   • Checks the certificate chain

Checking in a browser

1. Open the site in Chrome or Firefox
2. Click the padlock in the address bar
3. Connection is secure → Certificate is valid
4. Look at the details:
   • Issued to
   • Issued by
   • Valid from/to

Checking from the command line

# OpenSSL
openssl s_client -connect example.com:443 -servername example.com

# Check the expiry date
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Check the chain
openssl s_client -connect example.com:443 -showcerts

Fixing mixed content

“Mixed Content” is when an HTTPS page loads HTTP resources.

Types of mixed content

Passive Mixed Content

Images, video, audio

A warning is shown in the console

Active Mixed Content

Scripts, styles, iframes, AJAX

Blocked by the browser!

Finding mixed content

1. Open the site over HTTPS
2. Open Dev Tools (F12)
3. Go to the Console tab
4. Look for warnings:

Mixed Content: The page at 'https://example.com/' 
was loaded over HTTPS, but requested an insecure image 
'http://example.com/image.jpg'

Fixing it

Method 1: Relative URLs

Replace absolute URLs with relative ones:

Before:

<img src="http://example.com/image.jpg">
<script src="http://example.com/script.js"></script>

After:

<img src="/image.jpg">
<script src="/script.js"></script>

Method 2: Protocol-relative URLs

Before:

<script src="http://external.com/script.js"></script>

After:

<script src="//external.com/script.js"></script>

Method 3: Content Security Policy

In .htaccess:

Header always set Content-Security-Policy "upgrade-insecure-requests;"

This automatically upgrades HTTP requests to HTTPS.

Method 4: Search and replace in the database (WordPress)

Use the Better Search Replace plugin, or SQL:

UPDATE wp_posts 
SET post_content = REPLACE(post_content, 
    'http://example.com', 
    'https://example.com');

UPDATE wp_options 
SET option_value = REPLACE(option_value, 
    'http://example.com', 
    'https://example.com');

Wildcard SSL certificates

Wildcard certificates cover a domain and all its subdomains.

Coverage

A certificate for *.example.com covers:

• sub1.example.com ✅
• sub2.example.com ✅
• any.example.com ✅
• example.com ❌ (needs its own)
• sub.sub1.example.com ❌ (multi-level subdomains are not covered)

Installing a wildcard through AutoSSL

A Let's Encrypt wildcard requires the DNS-01 challenge:

1. Go to AutoSSL
2. Check whether your hosting supports DNS-01
3. Or install it manually:
   1. certbot certonly --manual --preferred-challenges=dns
   2. Add a TXT record to DNS
   3. Complete the validation

A wildcard from a commercial CA

1. Generate a CSR for *.example.com
2. Buy a wildcard certificate
3. Install it through Manage SSL sites

Advanced settings

HSTS (HTTP Strict Transport Security)

Makes the browser use HTTPS only:

In .htaccess:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Parameters:

• max-age – how long the browser remembers the setting (in seconds)
• includeSubDomains – applies to subdomains too
• preload – adds the site to the browsers’ preload list

OCSP Stapling

Speeds up certificate status checks:

This is normally configured at server level by the hosting provider.

To check:

openssl s_client -connect example.com:443 -status

You should see:

OCSP response: 
======================================
OCSP Response Status: successful (0x0)

Certificate Transparency

Logged automatically for Let's Encrypt.

To check:

• crt.sh
• Enter the domain
• Look at the certificates that have been issued

TLS versions

Modern configurations should support:

• TLS 1.3 ✅ (recommended)
• TLS 1.2 ✅ (minimum)
• TLS 1.1 ❌ (obsolete)
• TLS 1.0 ❌ (insecure)
• SSL 3.0 ❌ (critically vulnerable)

The hosting provider configures this in the Apache/Nginx configuration.

Monitoring expiry

Getting notifications

1. cPanel sends notifications about certificate problems, including certificates that are about to expire
2. Check your contact email address in Contact Information

Monitoring services

• SSL Monitor
• SSL Shopper Monitor
• SSL Labs (manual check)

Checking in cPanel

1. SSL/TLS Status
2. See the expiry date for all your domains
3. Statuses are updated daily

Troubleshooting

Warning: “Your connection is not private”

Causes:

• The certificate has expired
• The certificate was issued for a different domain
• A self-signed certificate
• A problem with the certificate chain

Solution:

1. Check the expiry date in SSL/TLS Status
2. Make sure the domain matches the Common Name
3. Install the correct CA Bundle
4. Reissue the certificate

Error “NET::ERR_CERT_COMMON_NAME_INVALID”

The domain does not match the certificate.

Solution:

1. Check which domain the certificate was issued for
2. Install a wildcard for subdomains
3. Or issue a separate certificate

Error “NET::ERR_CERT_AUTHORITY_INVALID”

The browser does not trust the certificate’s issuer.

Causes:

• A self-signed certificate
• The intermediate certificate is missing
• An internal corporate CA

Solution:

1. Install the full chain (CA Bundle)
2. Use a certificate from a trusted CA
3. Add the root certificate to the browser (for an internal CA)

AutoSSL is not renewing the certificate

Check:

1. The AutoSSL logs in cPanel
2. The DNS records are up to date
3. The site is reachable over HTTP (for validation)
4. A firewall isn’t blocking it
5. You haven’t exceeded the Let's Encrypt quota (50 certificates a week)

Manual renewal:

1. SSL/TLS Status
2. Run AutoSSL

The site is unavailable after installing SSL

Check:

1. Port 443 is open in the firewall
2. Apache/Nginx is listening on 443
3. The VirtualHost is configured for SSL
4. Restart the web server

This is normally set up automatically, but may need action from your hosting provider.

Best practices

1. Use HTTPS only
   • Redirect all HTTP traffic
   • Turn on HSTS
2. Monitor expiry dates
   • Set up notifications
   • Check monthly
3. Review your configuration regularly
   • Run an SSL Labs test once a quarter
   • Aim for a grade of A or A+
4. Keep TLS up to date
   • Disable old versions (TLS 1.0, 1.1)
   • Use modern ciphers
5. Protect your private keys
   • Don’t store them in public repositories
   • Restrict access (chmod 600)
   • Replace them promptly if they are compromised

See also

• Setting up redirects to HTTPS
• Fixing mixed content
• Optimising SSL performance
• General website security

External links

• Let's Encrypt
• SSL Labs Server Test
• cPanel SSL/TLS Documentation
• Browser TLS Support
• SSL Server Test