cPanel Server Hostname Certificates: Safe Renewal and Verification

The server hostname certificate used by WHM, cPanel or mail services is a different task from AutoSSL coverage for a customer’s website. Do not replace working service certificates with self-signed ones merely to trigger a new request.

Confirm the hostname and certificate owner

The authorized server administrator should confirm the configured hostname, public DNS, service endpoints and current certificate coverage. Check any separately managed paid or organizational certificate before using an automatic replacement route. A customer without server administration access should report the exact hostname and warning to support.

Use the documented service-certificate workflow

Review WHM’s Manage Service SSL Certificates and the documented hostname-certificate requirements for the installed version. cPanel can request hostname certificates through its maintenance workflow when requirements are met. The checkallsslcerts utility can check and replace service certificates; it is a mutating administrator operation, not a harmless browser troubleshooting command.

Account AutoSSL provider selection does not by itself prove which issuer will handle the server hostname. The old recipe’s mandatory Let’s Encrypt plugin install and self-signed replacement sequence are not necessary general prerequisites and were retired.

If issuance or renewal fails

Review the specific DNS, hostname, validation, licensing or replacement error and the actual script result. Resolve that prerequisite rather than repeatedly resetting certificates. Plan any required service change with recovery access and a maintenance window; mail, panel and FTP endpoints can be affected differently.

Verify the services actually used

Test the intended hostname and each relevant service without bypassing certificate warnings. Check the name, chain, validity and renewal ownership. Success on a website’s port does not establish success on WHM or SMTP. Retain diagnostic logs without exposing private keys or credentials.

References: checkallsslcerts scope; hostname-certificate prerequisites.

Reviewed October 14, 2026. No root script, certificate reset or service restart was executed.