{"id":3650,"date":"2016-03-07T03:37:47","date_gmt":"2016-03-07T08:37:47","guid":{"rendered":"https:\/\/underhost.com\/blog\/?p=3650"},"modified":"2026-10-23T09:50:22","modified_gmt":"2026-10-23T13:50:22","slug":"free-ssl-install-lets-encrypt-cpanel-centos-servers","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/free-ssl-install-lets-encrypt-cpanel-centos-servers\/","title":{"rendered":"Free SSL in 2026: Let&#8217;s Encrypt on cPanel (AutoSSL) and on Linux Servers (Certbot)"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-sliders-h\" style=\"color:#00D4FF;\"><\/i> Control Panels<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">Free SSL in 2026: Let&#8217;s Encrypt on cPanel (AutoSSL) and on Linux Servers (Certbot)<\/h1>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> On a cPanel server, use AutoSSL: in WHM open <strong>SSL\/TLS &gt; Manage AutoSSL<\/strong>, choose a provider, and run it for all users. Certificates install and renew on their own. On a server without a control panel, install <strong>Certbot<\/strong> and run <code>sudo certbot --nginx<\/code> or <code>sudo certbot --apache<\/code>. Certbot sets up automatic renewal. Check renewal with <code>sudo certbot renew --dry-run<\/code>.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#how-free-ssl-certificates-work\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">How free SSL certificates work<\/a><\/li>\n<li><a href=\"#option-1-cpanel-and-whm-autossl\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 1: cPanel and WHM (AutoSSL)<\/a><\/li>\n<li><a href=\"#option-2-linux-servers-without-a-control-panel-c\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 2: Linux servers without a control panel (Certbot)<\/a><\/li>\n<li><a href=\"#check-automatic-renewal\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Check automatic renewal<\/a><\/li>\n<li><a href=\"#redirect-http-to-https\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Redirect HTTP to HTTPS<\/a><\/li>\n<li><a href=\"#common-mistakes-after-switching-to-https\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Common mistakes after switching to HTTPS<\/a><\/li>\n<li><a href=\"#certificates-for-mail-and-cpanel-services\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Certificates for mail and cPanel services<\/a><\/li>\n<li><a href=\"#wildcard-and-ip-address-certificates\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Wildcard and IP address certificates<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"how-free-ssl-certificates-work\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> How free SSL certificates work<\/h2>\n<p style=\"margin:0 0 18px;\">Let&#8217;s Encrypt is a free, automated certificate authority. Before it issues a certificate, it checks that you control the domain, usually by fetching a file from the website (HTTP validation) or by checking a DNS record (DNS validation). The certificate is valid for a short time and is renewed automatically before it expires.<\/p>\n<p style=\"margin:0 0 18px;\">Let&#8217;s Encrypt certificates have been valid for 90 days. Let&#8217;s Encrypt is reducing standard certificate lifetimes towards 45 days over the next few years, which makes automatic renewal even more important. Never rely on renewing by hand.<\/p>\n<h2 id=\"option-1-cpanel-and-whm-autossl\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Option 1: cPanel and WHM (AutoSSL)<\/h2>\n<p style=\"margin:0 0 18px;\">AutoSSL is built into cPanel. It issues and renews certificates for every domain on the server, including addon domains and subdomains.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Log in to WHM as root.<\/li>\n<li style=\"margin:0 0 8px;\">Go to <strong>SSL\/TLS &gt; Manage AutoSSL<\/strong>.<\/li>\n<li style=\"margin:0 0 8px;\">On the <strong>Providers<\/strong> tab, choose an AutoSSL provider (for example Let&#8217;s Encrypt) and save.<\/li>\n<li style=\"margin:0 0 8px;\">On the <strong>Manage Users<\/strong> tab, make sure AutoSSL is enabled for the accounts that need it.<\/li>\n<li style=\"margin:0 0 8px;\">Click <strong>Run AutoSSL For All Users<\/strong>, then check the logs on the <strong>Logs<\/strong> tab.<\/li>\n<\/ol>\n<p style=\"margin:0 0 18px;\">Account owners can check their own certificates in cPanel under <strong>Security &gt; SSL\/TLS Status<\/strong>, and run AutoSSL for their domains from there.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Why AutoSSL skips a domain<\/h3>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Log message or symptom<\/th>\n<th style=\"padding:14px;text-align:left;\">Cause<\/th>\n<th style=\"padding:14px;text-align:left;\">Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Domain does not resolve to this server<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">DNS points elsewhere (for example a CDN or an old server)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Point the A record at the server, or use DNS validation.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Validation file not reachable<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">An .htaccess redirect or a security rule blocks <code>\/.well-known\/<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Allow <code>\/.well-known\/acme-challenge\/<\/code> before other rewrite rules.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Rate limit reached<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Too many certificates were requested for the same domain in a short time<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Wait, then run AutoSSL again. Avoid repeated manual runs.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">www works, the bare domain does not (or the reverse)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">One of the names has no DNS record<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Add the missing A or CNAME record.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"option-2-linux-servers-without-a-control-panel-c\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> Option 2: Linux servers without a control panel (Certbot)<\/h2>\n<p style=\"margin:0 0 18px;\">Certbot is the official Let&#8217;s Encrypt client from the EFF. Install it from your distribution&#8217;s packages.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Debian and Ubuntu<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo apt update\nsudo apt install -y certbot python3-certbot-nginx     # or python3-certbot-apache\nsudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">AlmaLinux and Rocky Linux<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo dnf install -y epel-release\nsudo dnf install -y certbot python3-certbot-nginx  # or python3-certbot-apache\nsudo certbot --nginx -d example.com -d www.example.com<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Certbot asks for an email address for expiry notices, gets the certificate, and updates the web server configuration to use HTTPS. Replace <code>example.com<\/code> with your domain, and list every name the certificate should cover.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Certificate only, without changing the web server<\/h3>\n<p style=\"margin:0 0 18px;\">If you prefer to edit the web server configuration yourself, use the webroot method. It only places the validation file in your site folder:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo certbot certonly --webroot -w \/var\/www\/example.com\/public -d example.com -d www.example.com<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">The certificate and key are saved in <code>\/etc\/letsencrypt\/live\/example.com\/<\/code>. Point your web server at <code>fullchain.pem<\/code> and <code>privkey.pem<\/code>.<\/p>\n<h2 id=\"check-automatic-renewal\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-clipboard-check\" style=\"color:#00D4FF;\"><\/i> Check automatic renewal<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># Test renewal without changing anything\nsudo certbot renew --dry-run\n\n# Check that the renewal timer is active\nsystemctl list-timers | grep -i certbot\n\n# See which certificates exist and when they expire\nsudo certbot certificates<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">If the dry run fails, fix it now: the same error will stop the real renewal. The most common cause is a firewall or redirect that blocks the validation request.<\/p>\n<h2 id=\"redirect-http-to-https\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Redirect HTTP to HTTPS<\/h2>\n<p style=\"margin:0 0 18px;\">Once the certificate works, send all visitors to HTTPS. On cPanel, turn on <strong>Force HTTPS Redirect<\/strong> for each domain under <strong>Domains<\/strong>. With Certbot, choose the redirect option when it asks. Then update the site&#8217;s own URL settings, for example the WordPress Address and Site Address, so pages do not load mixed content.<\/p>\n<h2 id=\"common-mistakes-after-switching-to-https\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Common mistakes after switching to HTTPS<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Mistake<\/th>\n<th style=\"padding:14px;text-align:left;\">What happens<\/th>\n<th style=\"padding:14px;text-align:left;\">How to avoid it<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Mixed content<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The browser shows a warning or blocks images and scripts loaded over HTTP<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Update links in the database and theme to HTTPS. In WordPress, a search-and-replace of the old URL fixes most cases.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Turning on HSTS too early<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Visitors cannot reach the site if the certificate later fails<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Enable HSTS only after HTTPS has worked for a while, and start with a short max-age.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Wrong SSL mode on a CDN<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Redirect loops, or traffic that is unencrypted between the CDN and the server<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">With Cloudflare, use Full (strict) once the server has a valid certificate.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Certificate for www only<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The bare domain shows a certificate error<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Include both names when you request the certificate.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"certificates-for-mail-and-cpanel-services\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Certificates for mail and cPanel services<\/h2>\n<p style=\"margin:0 0 18px;\">Website certificates do not cover the server&#8217;s own services, such as WHM, cPanel, webmail and the mail server, when clients connect to the server&#8217;s hostname. In WHM, check <strong>Service Configuration &gt; Manage Service SSL Certificates<\/strong>. The hostname needs a valid certificate too, so mail clients connect without warnings. If you change the server hostname, check this page again.<\/p>\n<h2 id=\"wildcard-and-ip-address-certificates\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Wildcard and IP address certificates<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Wildcard certificates<\/strong> (<code>*.example.com<\/code>) need DNS validation. Certbot supports this with a DNS plugin for your DNS provider.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Certificates for an IP address<\/strong> are possible with Let&#8217;s Encrypt short-lived certificates. See our guide to <a href=\"https:\/\/underhost.com\/blog\/ssl-for-public-ips-guide-to-lets-encrypt-without-a-domain\/\">SSL for public IPs<\/a>.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">For more on securing a cPanel server, see our <a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">cPanel security tips<\/a> and the <a href=\"https:\/\/underhost.com\/blog\/how-to-install-and-configure-csf-firewall-on-your-server\/\">CSF firewall guide<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Want SSL handled for you? Our cPanel hosting includes AutoSSL, and our server management team can set up Certbot on your VPS.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is a free Let&#8217;s Encrypt certificate as secure as a paid one?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes, for encryption. Let&#8217;s Encrypt certificates use the same encryption as paid domain-validated certificates. Paid certificates can add organisation validation or a warranty, but the connection security is the same.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How often do Let&#8217;s Encrypt certificates renew?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">They have been valid for 90 days, and Let&#8217;s Encrypt is reducing standard lifetimes towards 45 days. AutoSSL and Certbot renew them automatically before they expire.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Why did AutoSSL not issue a certificate for my domain?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Usually because the domain does not point to the server, or because a redirect or security rule blocks the validation file. Check the AutoSSL logs in WHM for the exact reason.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Do I need a dedicated IP address for SSL?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">No. Modern browsers and servers use SNI (Server Name Indication), which lets many sites share one IP address, each with its own certificate. A dedicated IP is only needed for a certificate issued for the IP address itself.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Can I get a wildcard certificate for free?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. Let&#8217;s Encrypt issues wildcard certificates, but only with DNS validation, so you need a DNS plugin or API access to your DNS provider.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/essential-free-cpanel-plugins-for-server-management\/\">Essential Free cPanel Plugins for Server Management<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/ssl-for-public-ips-guide-to-lets-encrypt-without-a-domain\/\">SSL for Public IPs: Guide to Let&#8217;s Encrypt Without a Domain<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/wordpress-made-easy-how-to-use-wordpress-toolkit-for-hassle-free-management\/\">WordPress Made Easy: How to Use WordPress Toolkit for Hassle-Free Management<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-cpanel-redis-manager-brings-faster-application-performance-to-your-server\/\">How cPanel Redis Manager Brings Faster Application Performance to Your Server<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-use-redis-manager-in-cpanel-to-boost-website-speed\/\">How to Use Redis Manager in cPanel to Boost Website Speed<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is a free Let's Encrypt certificate as secure as a paid one?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, for encryption. Let's Encrypt certificates use the same encryption as paid domain-validated certificates. Paid certificates can add organisation validation or a warranty, but the connection security is the same.\"}}, {\"@type\": \"Question\", \"name\": \"How often do Let's Encrypt certificates renew?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"They have been valid for 90 days, and Let's Encrypt is reducing standard lifetimes towards 45 days. AutoSSL and Certbot renew them automatically before they expire.\"}}, {\"@type\": \"Question\", \"name\": \"Why did AutoSSL not issue a certificate for my domain?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Usually because the domain does not point to the server, or because a redirect or security rule blocks the validation file. Check the AutoSSL logs in WHM for the exact reason.\"}}, {\"@type\": \"Question\", \"name\": \"Do I need a dedicated IP address for SSL?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. Modern browsers and servers use SNI (Server Name Indication), which lets many sites share one IP address, each with its own certificate. A dedicated IP is only needed for a certificate issued for the IP address itself.\"}}, {\"@type\": \"Question\", \"name\": \"Can I get a wildcard certificate for free?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Let's Encrypt issues wildcard certificates, but only with DNS validation, so you need a DNS plugin or API access to your DNS provider.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/letsencrypt.org\/getting-started\/\">Let&#8217;s Encrypt: getting started<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/certbot.eff.org\/instructions\">Certbot instructions (EFF)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.cpanel.net\/whm\/ssl-tls\/manage-autossl\/\">cPanel documentation: Manage AutoSSL<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/letsencrypt.org\/2026\/01\/15\/6day-and-ip-general-availability\">Let&#8217;s Encrypt: 6-day and IP certificates<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>On a cPanel server, use AutoSSL: in WHM open SSL\/TLS > Manage AutoSSL, choose a provider, and run it for all users. Certificates install and renew on their own. On a server without a control panel, install Certbot and run sudo certbot &#8211;nginx or sudo certbot &#8211;apache. Certbot sets up automatic renewal. Check renewal with sudo certbot renew &#8211;dry-run.<\/p>\n","protected":false},"author":1,"featured_media":344,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,202,203],"tags":[108,122,123,115,124,109],"class_list":["post-3650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-control-panels","category-cpanel-whm","category-security","tag-tag-cpanel","tag-tag-dns","tag-tag-domains","tag-tag-linux-server","tag-tag-ssl","tag-tag-whm"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3650"}],"version-history":[{"count":14,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3650\/revisions"}],"predecessor-version":[{"id":7007,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3650\/revisions\/7007"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/344"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}