AutoSSL and Let’s Encrypt on cPanel

AutoSSL is the feature in cPanel that requests and installs free certificates from Let’s Encrypt for the hostnames on your account. Let’s Encrypt is the certificate authority; AutoSSL is the automation that talks to it, renews on time, and places the chain on the server. On our shared hosting, that runs on cPanel without any root access from you.

What AutoSSL needs from your site

AutoSSL uses the HTTP-01 challenge. The certificate authority must reach http://your-hostname/.well-known/acme-challenge/… on the public internet. DNS for that name has to point at this account, not an old host or a local hosts file. Port 80 must answer on that vhost so the challenge can complete.

Addon domains, www, and names like mail.example.com are checked one by one. A failure on a single name is not a global Let’s Encrypt outage. It usually means that one hostname still has a DNS, firewall, or CDN problem.

Reading the SSL/TLS Status page

Open cPanel and go to SSL/TLS Status. That page is the dashboard for AutoSSL on your account. Red rows most often mean DNS still points elsewhere, port 80 is filtered, a CAA record blocks letsencrypt.org, or you hit a Let’s Encrypt rate limit after many quick changes.

Read the status text on the row and include it when you write in. A note that only says “SSL is red” does not tell us which check failed. After you fix DNS or the challenge path, wait for TTL if you just moved the A record, then run AutoSSL again from that same page.

CDN, wildcards, and when HTTP-01 is the wrong tool

If a CDN sits in front of the name, the challenge path must still reach this server. Bypass /.well-known/acme-challenge at the CDN, or pause proxying on that hostname until the certificate is issued. Leaving a full proxy in place without a bypass is a common reason AutoSSL stays red.

DNS-01 proves control with a TXT record at _acme-challenge and does not need port 80. AutoSSL on cPanel does not use DNS-01 by default. Wildcards and names that cannot speak HTTP over the public internet need a different certificate approach, not endless AutoSSL retries.

Mixed content after a successful issue is separate from AutoSSL. The robot installs the certificate; it does not rewrite links inside your HTML or your CMS.