Free SSL certificates with AutoSSL: Difference between revisions

From Acenet Knowledgebase
Jump to navigation Jump to search
← Older edit
Docs admin (talk | contribs)
Bureaucrats, Administrators
2,795 edits
No edit summary
Rewritten for current Acenet services (Main Page refresh)
 
(One intermediate revision by the same user not shown)
Line 1: Line 1:
AutoSSL is the solution to one of the biggest headaches that exists for every cPanel & WHM user: SSL installation and renewal. AutoSSL installs FREE signed SSL certificates that are automatically generated and installed on the server. There is no need for you to generate a certificate signing request (CSR), pay a Certificate Authority (CA) for each certificate, or renew certificates when they expire. cPanel takes care of everything for you.  
Every website on our cPanel servers gets a free SSL certificate from '''AutoSSL''', so visitors can use your site securely over https://. AutoSSL installs the certificate automatically and renews it before it expires. You don't need to buy, request or renew anything.
<br><br>
If your website is on a shared server, AutoSSL is already enabled.  If your existing SSL certificate is expiring in the next week, a new SSL certificate will automatically be provisioned and installed.  If you have never had an SSL certificate installed before, there should be one installed now.
<br><br>
If you are on a Cloud or Dedicated server, you may need to check that AutoSSL is enabled.
<br><br>


AutoSSL covers each domain and subdomain in your account, including the www. version and the mail. address, as long as they point to our server.


===How to Enable AutoSSL===
== Check your certificates ==
By default, only cPanel is listed as a SSL provider.  There is a plugin available for Let's Encrypt.  It can be installed by logging into SSH on your cPanel server as root, and running the following command:


<syntaxhighlight lang="bash">/scripts/install_lets_encrypt_autossl_provider</syntaxhighlight>
'''1.''' Log in to cPanel and go to '''Security''' > '''SSL/TLS Status'''.


In WHM, navigate to SSL/TLS -> Manage AutoSSL.   Select a SSL Provider, check mark any additional checkboxes offered, and click Save.  
'''2.''' Each domain shows its certificate status. A green padlock means it's covered.


Once saved, click the "Run AutoSSL for All Users" button. This will start the initial cronjob run to identify domains resolving to the server that do not have an SSL (or have an expired SSL Certificate), or have a valid certificate about to expire.  The cronjob will generate and install the SSL certificate for all valid domains.
'''3.''' If a domain isn't covered yet, click '''Run AutoSSL'''. It takes a few minutes.


To send all visitors to the secure address, go to '''Domains''' > '''Domains''' and turn on '''Force HTTPS Redirect''' for your domain.


[[File:autossl.png]]
== If a domain doesn't get a certificate ==


===How to Troubleshoot AutoSSL===
The status on '''SSL/TLS Status''' explains why. The most common reasons are:


If you have any problem with the application, you can view the logs for AutoSSL right from the WHM interface. After the first run of the cronjob you’ll see the logs listed in the ‘Logs’ tab. You can load the log by selecting the log file you’d like to view and clicking ‘View Log’.
* '''The domain doesn't point to our server yet.''' AutoSSL can only issue a certificate once the domain's DNS points here. After you change nameservers or DNS records, allow a few hours, then click '''Run AutoSSL''' again.
* '''Cloudflare or another proxy.''' If the domain uses Cloudflare's proxy, set Cloudflare's SSL mode to '''Full (strict)''', and make sure nothing blocks the <code>/.well-known/</code> folder, which AutoSSL uses to confirm the domain.
* '''Rules that block verification.''' Rules in your <code>.htaccess</code> file, or a security plugin, can block the <code>/.well-known/</code> folder. Allow access to it, then run AutoSSL again.
* '''Unused subdomains.''' Subdomains you don't use, such as ''cpanel.'' or ''webdisk.'', can show as not covered. That's harmless.


[[File:autossl2.png]]
== Mixed content warnings ==
 
If your site has a certificate but the browser still shows a warning or no padlock, the page is loading some images or scripts over http://. Update those links to https://. In WordPress, update the '''WordPress Address''' and '''Site Address''' under '''Settings''' > '''General''' to start with https://.
 
== Your own server ==
 
On a cloud server or dedicated server, AutoSSL is set up in WHM under '''SSL/TLS''' > '''Manage AutoSSL'''. Choose a provider, such as Let's Encrypt or Sectigo, and click '''Run AutoSSL For All Users'''. The '''Logs''' tab shows what happened for each domain. See cPanel's [https://docs.cpanel.net/whm/ssl-tls/manage-autossl/ Manage AutoSSL] documentation.
 
If you need a certificate with extra validation, such as an organization-validated certificate, please [[Open a support ticket|open a support ticket]] in the '''Sales and Billing''' department.
 
[[Category:cPanel]]

Latest revision as of 14:21, 27 October 2026

Every website on our cPanel servers gets a free SSL certificate from AutoSSL, so visitors can use your site securely over https://. AutoSSL installs the certificate automatically and renews it before it expires. You don't need to buy, request or renew anything.

AutoSSL covers each domain and subdomain in your account, including the www. version and the mail. address, as long as they point to our server.

Check your certificates

1. Log in to cPanel and go to Security > SSL/TLS Status.

2. Each domain shows its certificate status. A green padlock means it's covered.

3. If a domain isn't covered yet, click Run AutoSSL. It takes a few minutes.

To send all visitors to the secure address, go to Domains > Domains and turn on Force HTTPS Redirect for your domain.

If a domain doesn't get a certificate

The status on SSL/TLS Status explains why. The most common reasons are:

  • The domain doesn't point to our server yet. AutoSSL can only issue a certificate once the domain's DNS points here. After you change nameservers or DNS records, allow a few hours, then click Run AutoSSL again.
  • Cloudflare or another proxy. If the domain uses Cloudflare's proxy, set Cloudflare's SSL mode to Full (strict), and make sure nothing blocks the /.well-known/ folder, which AutoSSL uses to confirm the domain.
  • Rules that block verification. Rules in your .htaccess file, or a security plugin, can block the /.well-known/ folder. Allow access to it, then run AutoSSL again.
  • Unused subdomains. Subdomains you don't use, such as cpanel. or webdisk., can show as not covered. That's harmless.

Mixed content warnings

If your site has a certificate but the browser still shows a warning or no padlock, the page is loading some images or scripts over http://. Update those links to https://. In WordPress, update the WordPress Address and Site Address under Settings > General to start with https://.

Your own server

On a cloud server or dedicated server, AutoSSL is set up in WHM under SSL/TLS > Manage AutoSSL. Choose a provider, such as Let's Encrypt or Sectigo, and click Run AutoSSL For All Users. The Logs tab shows what happened for each domain. See cPanel's Manage AutoSSL documentation.

If you need a certificate with extra validation, such as an organization-validated certificate, please open a support ticket in the Sales and Billing department.

Retrieved from "https://kb.acenet.us/index.php?title=Free_SSL_certificates_with_AutoSSL&oldid=2994"