SSL on addon domains and mail

SSL on addon domains and mail means every hostname a browser or mail client uses must appear on a certificate. AutoSSL can issue those names once public DNS points here and validation succeeds. Web mail in the browser often looks fine while desktop clients still warn, because they connect to a different name.

Which names need to be on the certificate

Addon domains on cPanel are separate virtual hosts. They receive AutoSSL when their A or AAAA records point to your account and HTTP-01 validation works, the same way the primary domain does. Parked aliases may share a certificate; addon domains do not automatically share one. Include www if customers type it, or redirect www to the bare domain so you only need one name.

Mail TLS depends on the hostname the client actually connects to. If you tell people to use mail.example.com, that name must be on the certificate the mail service presents. IMAP and submission on ports 993, 465, and 587 still check the name under STARTTLS or implicit TLS. Roundcube in the browser is not a test of Thunderbird or Outlook, because the browser is using the web hostname instead.

Wait for AutoSSL on the mail hostname

Do not send IMAP setup instructions the same morning you add an addon domain. Open SSL/TLS Status in cPanel and wait until mail.example.com shows a valid certificate. Only then put that hostname in the client settings you share with the customer.

If AutoSSL cannot issue because mail.example.com is a CNAME at a filtering vendor, either use a certificate on that vendor or tell clients to connect to a name you control. Keep those two approaches separate so the instructions stay clear. On shared hosting you should not hand customers the server hostname for mail; stick to names on their own domain once AutoSSL has covered them.

AutoSSL, paid certs, and what “one cert” really means

AutoSSL with Let’s Encrypt is the default on cPanel hosting and issues domain-validated names as DNS becomes ready. A paid SAN certificate that lists both web and mail names is fine if you already buy one for other reasons. There is no single certificate that covers every possible name by magic. SNI presents a certificate per hostname, so issue the names you actually use for the site and for mail TLS.