How AutoSSL works-free SSL on cPanel hosting
AutoSSL automatically provisions and renews free Let's Encrypt certificates on your cPanel account. Understand the renewal cycle, troubleshoot failures, and manage certificates.
UnderHost NOC
Network Operations
On this page
AutoSSL is cPanel's built-in system for automatically issuing and renewing free SSL certificates from Let's Encrypt (or Sectigo on some servers). It runs silently in the background-most users never need to touch it.
Renewal cycle
- Let's Encrypt certificates are valid for 90 days
- AutoSSL starts the renewal process when a certificate has fewer than 30 days remaining
- AutoSSL runs daily-typically at a scheduled time on the server
- You do not need to do anything for renewals on a properly configured account
Check certificate status
- Log in to cPanel
- Go to Security → SSL/TLS Status
- Each domain shows certificate status and expiry date
- To trigger a manual check, click Run AutoSSL
You can also see AutoSSL logs under Security → AutoSSL → Logs to see the results of the last run including any errors.
AutoSSL failures
| Error | Cause | Fix |
|---|---|---|
| DNS DCV failure | Domain's A record doesn't point to this server | Update DNS to point to the server IP, wait for propagation, rerun AutoSSL |
| HTTP DCV failure | Domain resolves to the server but HTTP is blocked | Ensure port 80 is open; remove any .htaccess redirect that blocks /.well-known/ |
| Rate limit exceeded | Too many certificates requested for the same domain in a short period | Wait-Let's Encrypt rate limits reset weekly |
| CAA record mismatch | A DNS CAA record restricts which CAs can issue certs for the domain | Add letsencrypt.org to the domain's CAA record, or remove the CAA restriction |
Exclude a domain from AutoSSL
If you have a paid SSL certificate installed on a domain and do not want AutoSSL to replace it, you can exclude that domain:
- Go to Security → SSL/TLS Status
- Find the domain you want to exclude
- Click the toggle to Disable AutoSSL for that domain
AutoSSL will skip that domain in future runs and will not overwrite your manually installed certificate.
AutoSSL not working?
Troubleshoot AutoSSL failures or enable manual certificate renewal in cPanel.
