How free SSL certificates work

Let’s Encrypt is a free, automated certificate authority. Before it issues a certificate, it checks that you control the domain, usually by fetching a file from the website (HTTP validation) or by checking a DNS record (DNS validation). The certificate is valid for a short time and is renewed automatically before it expires.

Let’s Encrypt certificates have been valid for 90 days. Let’s Encrypt is reducing standard certificate lifetimes towards 45 days over the next few years, which makes automatic renewal even more important. Never rely on renewing by hand.

Option 1: cPanel and WHM (AutoSSL)

AutoSSL is built into cPanel. It issues and renews certificates for every domain on the server, including addon domains and subdomains.

1. Log in to WHM as root.
2. Go to SSL/TLS > Manage AutoSSL.
3. On the Providers tab, choose an AutoSSL provider (for example Let’s Encrypt) and save.
4. On the Manage Users tab, make sure AutoSSL is enabled for the accounts that need it.
5. Click Run AutoSSL For All Users, then check the logs on the Logs tab.

Account owners can check their own certificates in cPanel under Security > SSL/TLS Status, and run AutoSSL for their domains from there.

Why AutoSSL skips a domain

Option 2: Linux servers without a control panel (Certbot)

Certbot is the official Let’s Encrypt client from the EFF. Install it from your distribution’s packages.

Debian and Ubuntu

sudo apt update
sudo apt install -y certbot python3-certbot-nginx     # or python3-certbot-apache
sudo certbot --nginx -d example.com -d www.example.com

AlmaLinux and Rocky Linux

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx  # or python3-certbot-apache
sudo certbot --nginx -d example.com -d www.example.com

Certbot asks for an email address for expiry notices, gets the certificate, and updates the web server configuration to use HTTPS. Replace example.com with your domain, and list every name the certificate should cover.

Certificate only, without changing the web server

If you prefer to edit the web server configuration yourself, use the webroot method. It only places the validation file in your site folder:

sudo certbot certonly --webroot -w /var/www/example.com/public -d example.com -d www.example.com

The certificate and key are saved in /etc/letsencrypt/live/example.com/. Point your web server at fullchain.pem and privkey.pem.

Check automatic renewal

# Test renewal without changing anything
sudo certbot renew --dry-run

# Check that the renewal timer is active
systemctl list-timers | grep -i certbot

# See which certificates exist and when they expire
sudo certbot certificates

If the dry run fails, fix it now: the same error will stop the real renewal. The most common cause is a firewall or redirect that blocks the validation request.

Redirect HTTP to HTTPS

Once the certificate works, send all visitors to HTTPS. On cPanel, turn on Force HTTPS Redirect for each domain under Domains. With Certbot, choose the redirect option when it asks. Then update the site’s own URL settings, for example the WordPress Address and Site Address, so pages do not load mixed content.

Common mistakes after switching to HTTPS

Certificates for mail and cPanel services

Website certificates do not cover the server’s own services, such as WHM, cPanel, webmail and the mail server, when clients connect to the server’s hostname. In WHM, check Service Configuration > Manage Service SSL Certificates. The hostname needs a valid certificate too, so mail clients connect without warnings. If you change the server hostname, check this page again.

Wildcard and IP address certificates

• Wildcard certificates (*.example.com) need DNS validation. Certbot supports this with a DNS plugin for your DNS provider.
• Certificates for an IP address are possible with Let’s Encrypt short-lived certificates. See our guide to SSL for public IPs.

For more on securing a cPanel server, see our cPanel security tips and the CSF firewall guide.