Free SSL for the server hostname and sites in WHM (AutoSSL)

WHM's AutoSSL gets free Let's Encrypt certificates for your sites and the server hostname and renews them. Check it in WHM under SSL/TLS » Manage AutoSSL.

Check the AutoSSL provider

1. Log in to WHM as root and go to SSL/TLS » Manage AutoSSL.

2. On the Providers tab, select Let's Encrypt™ if it isn't selected yet. Accept the terms of service if asked, then click Save.

3. On the Manage Users tab, check that AutoSSL is enabled for the accounts that should get certificates.

If Disabled is selected as provider, nobody on the server gets free certificates.

Get certificates for the websites now

AutoSSL runs on its own every day and after a new account is created. To start it now, click Run AutoSSL For All Users on the Manage AutoSSL page, or run it from SSH as root.

For all accounts:

/usr/local/cpanel/bin/autossl_check --all

For one cPanel account (replace username with the account's user name):

/usr/local/cpanel/bin/autossl_check --user=username

Issuing the certificates can take a little while. Then check the result on the Logs tab of Manage AutoSSL, or in the files in /var/cpanel/logs/autossl/. Open the site with https:// and click the padlock to see the certificate.

SSL for the server hostname

The hostname certificate secures WHM, cPanel, Webmail and the mail server when you open them with the server's name, for example https://server.example.com:2087. cPanel replaces a self-signed, invalid or soon expiring hostname certificate on its own during the nightly update. For that to work:

• The hostname is a fully qualified domain name such as server.example.com (see Change the hostname of a Linux server).
• An A record for the hostname points to the server's main IP address.
• The server's main IP and its shared IP are the same. Compare them:

  cat /var/cpanel/mainip
  grep ADDR /etc/wwwacct.conf

  If they differ, set the shared IP in Server Configuration » Basic WebHost Manager® Setup.

To request the hostname certificate right away instead of waiting for the night, run:

/usr/local/cpanel/bin/checkallsslcerts --allow-retry --verbose

It installs the certificate on all cPanel services. cPanel suggests running it by hand only when needed, since the nightly update does the same.

Check which certificate the server sends for WHM:

echo | openssl s_client -connect server.example.com:2087 -servername server.example.com 2>/dev/null | openssl x509 -noout -issuer -enddate

The issuer should name Let's Encrypt, and notAfter shows the expiry date. You can also see the certificates in Service Configuration » Manage Service SSL Certificates.

Common problems

AutoSSL skips a domain or a subdomain

Let's Encrypt can only issue a certificate for names that point to this server. Check each name, for example with dig +short www.example.com, and compare the IP with the server's. The Logs tab names the domain and the reason. Remove DNS records for names you don't use (such as cpcontacts or webdisk pointing elsewhere) or point them to the server.

"DCV" or "404" errors in the log

Let's Encrypt checks a file under /.well-known/ on the site. Redirects or rules in the site's .htaccess that block /.well-known/, or a CDN or proxy in front of the site, can make this check fail. Allow that path, or pause the proxy while the certificate is issued.

The hostname certificate stays self-signed

Check the A record of the hostname and that the main and shared IP match (see above), then run checkallsslcerts again and read its output.

"too many certificates" or rate limit errors

Let's Encrypt limits how many certificates you can request for the same names in a short time. Fix the cause first (usually DNS), then wait before you try again.

Related articles

• Change the hostname of a Linux server
• Install cPanel & WHM on AlmaLinux
• Update cPanel & WHM from the command line
• Free SSL: check and fix your certificate (AutoSSL)

Still stuck? Open a support ticket and we'll help.