How to Install an SSL Certificate in WHM

Two SSL Routes in WHM

Two routes, chosen per need:

1. AutoSSL (free, automatic) — WHM Home > SSL/TLS > Manage AutoSSL. Choose the provider: Let's Encrypt (rate-limited but universally trusted) or Sectigo via cPanel (the long default), then tick Enable AutoSSL Provider. Click Run AutoSSL for All Users for an immediate first issuance wave; from then on, daily checks renew certificates entering their expiry window automatically.
2. Purchased certificate per domain — generate the CSR in WHM (SSL/TLS > Generate an SSL Certificate and Signing Request), buy the certificate, then install under Manage SSL Hosts by pasting the cert; WHM autofills the key and bundle when they match.

AutoSSL is the answer for 95% of domains — paid certificates earn their keep on wildcard needs, OV/EV validation and warranty requirements; the SSL price guide compares them.

Route 1: Enabling AutoSSL (Free, Automatic)

Route one, enabling AutoSSL server-wide: WHM Home, SSL/TLS, Manage AutoSSL. Choose the provider — Let's Encrypt or Sectigo via cPanel — then tick Enable AutoSSL Provider.

The Users tab controls scope: All Users including resellers' accounts, versus selected. The Options tab carries the sharp edges: 'Allow AutoSSL to replace invalid or expiring certificates' — leave enabled, it self-heals — and the HTTP-validation versus remote-domains settings governing domains resolving elsewhere. Click Run AutoSSL for All Users to force an immediate first issuance wave; the queue report shows per-domain results. Users can trigger their own via cPanel, SSL/TLS Status, Run AutoSSL — the same machinery for their domains.

Fixing AutoSSL Failures (DNS, validation)

AutoSSL failures decode to domain-control validation problems, and the log names them — WHM Home, SSL/TLS, Manage AutoSSL, the Logs tab shows each domain's failure verbatim. The four classics:

• Domain not pointing to this server — the A record resolves elsewhere (parked, DNS moved, CDN intercepting); fix the DNS or exclude the domain.

• Redirected or blocked validation — a force-HTTPS rule bounces the validator's request to http://domain/.well-known/pki-validation/…, which must answer 200 over plain HTTP; add a .well-known exclusion or disable the redirect until issued.

• Cloudflare proxying — the orange cloud intercepts HTTP validation; grey-cloud the records during issuance or use a provider with DNS validation.

• Newly-added subdomains failing while the parent succeeds — stale DNS for the specific hostname.

Persistent failures with correct DNS: run the AutoSSL check and read the exact response in the log — it is always concrete, never vibes.

Route 2: Installing a Purchased Certificate

On Manage SSL for a cPanel site, the honest summary is that defaults matter more than brand names — a well-set budget plan outranks a mis-tuned premium one. WebJi® documents its defaults openly and adjusts them per ticket when workloads need it.

Generating a CSR in WHM

How this plays out with service SSL certificates (mail, WHM, cPanel): settings that look cosmetic usually decide page speed and uptime under real traffic. The defaults WebJi® ships are tuned for Indian network conditions, and support can review your setup on request.

Service SSLs: WHM, cPanel, Mail, FTP

Install the certificate on the account that actually serves the site, force HTTPS, then view the page source for http:// images, stylesheets or scripts. The padlock stays broken until those are HTTPS too. Renewal should be automatic; if the padlock disappears, check that the certificate is still bound to this hostname.

Forcing HTTPS Site-Wide

How this plays out with SSL virtual host warnings: settings that look cosmetic usually decide page speed and uptime under real traffic. The defaults WebJi® ships are tuned for Indian network conditions, and support can review your setup on request.