Manage AutoSSL in WHM and cPanel: Coverage and Validation

AutoSSL can obtain and renew domain-validated certificates for eligible cPanel accounts, but issuance still depends on domain validation, account eligibility and provider limits. Enabling it is not proof that every hostname is covered or that renewal will always succeed.

Separate account access from server administration

A hosting customer normally checks certificate status in cPanel. Selecting the server’s provider and managing account eligibility require authorized WHM access. If those controls are unavailable, ask the hosting administrator rather than installing a second plugin or running root commands.

Review the current configuration

In WHM’s Manage AutoSSL interface, inspect the configured provider and the account’s feature-list/user eligibility. Current cPanel documentation lists Let’s Encrypt as the default provider; older installations and host policy can differ. The historical Comodo-only claim is not current guidance. Review provider terms before accepting them.

Check replacement behavior deliberately, especially if a site has an OV/EV or other separately managed certificate. Automatic domain validation does not preserve organization-validation features. Do not change all users’ settings merely to troubleshoot one domain.

Request and verify coverage

1. Confirm that the domain belongs to the correct cPanel account and that its public DNS and validation route reach the intended infrastructure.
2. Check the account’s certificate-status screen for included/excluded names. Wildcard capability depends on the provider and successful DNS validation, not just a checkbox.
3. Use the account-specific check when investigating that account. Review the resulting log or pending status; a queued request is not a completed installation.
4. Verify each required hostname externally without bypassing warnings, then monitor renewal failures and expiry.

When validation fails

Use the actual failure message to distinguish DNS, CAA, HTTP routing, authentication, exclusions and rate-limit problems. Avoid repeated blind requests or disabling site-wide security. For rewrite failures, see the validation-routing guide.

This guide replaces the overlapping legacy Let’s Encrypt plugin walkthrough. Its Python 2/CentOS-era repository setup and seconds-to-completion promises were retired; installing that plugin is not a prerequisite for a current provider-managed workflow. Server-hostname certificates are a separate service-certificate task.

References: Manage AutoSSL; account certificate status; validation methods.

Reviewed October 14, 2026. No provider registration, terms acceptance, plugin installation or live certificate issuance was performed.