Skip to content
Sign In Get Started

SSL & HTTPS

Certificates, AutoSSL, HSTS, mixed content, and TLS versions.

  1. How TLS certificates workHow TLS certificates workA TLS certificate binds a public key to a trusted name. Browsers check the name, dates, and chain so HTTPS can encrypt the connection after DNS already found…Updated Aug 29, 2026
  2. AutoSSL and Let’s Encrypt on cPanelAutoSSL and Let’s Encrypt on cPanelAutoSSL is cPanel’s automation that requests Let’s Encrypt certificates for your hostnames. It needs public DNS and port 80 so the HTTP-01 challenge can succeed.Updated Aug 29, 2026
  3. Mixed content after forcing HTTPSMixed content after forcing HTTPSMixed content is leftover http:// inside an HTTPS page. Search-replace stored URLs in the database, purge cache, and confirm with curl—force plugins alone will not rewrite old HTML.Updated Aug 29, 2026
  4. HSTS: when to turn it onHSTS: when to turn it onTurn HSTS on only after HTTPS is stable. Start with a short max-age, skip preload during moves, and leave the header off until every hostname you need is…Updated Aug 29, 2026
  5. DV, OV, and EV certificatesDV, OV, and EV certificatesA DV certificate proves domain control. OV and EV add organization checks, but browsers no longer show a green bar, and AutoSSL Let’s Encrypt DV encrypts the same…Updated Aug 29, 2026
  6. Why AutoSSL failsWhy AutoSSL failsWhen AutoSSL failed, read SSL/TLS Status first. DNS, port 80, CAA, rate limits, or a CDN usually block Let’s Encrypt HTTP-01—not an outage at the CA.Updated Aug 29, 2026
  7. TLS 1.2 and 1.3TLS 1.2 and 1.3TLS 1.3 is enabled on our LiteSpeed hosting, and TLS 1.2 is the minimum we keep. Older 1.0 and 1.1 stay off; a PCI scan that wants them…Updated Aug 29, 2026
  8. CAA recordsCAA recordsA CAA record lists which certificate authorities may issue for your domain. Include letsencrypt.org when you use AutoSSL, or leave CAA empty if any CA is fine.Updated Aug 29, 2026
  9. Redirect HTTP to HTTPS without loopsRedirect HTTP to HTTPS without loopsAn HTTPS redirect should be one 301 to your canonical host. Count hops with curl, keep a single writer, and align WordPress and any CDN so the chain…Updated Aug 29, 2026
  10. SSL on addon domains and mailSSL on addon domains and mailMail TLS needs the hostname the client connects to on the certificate. AutoSSL issues each name after DNS points here. A web-only cert leaves Thunderbird warning on mail.example.com.Updated Aug 29, 2026
  11. ACME HTTP-01 vs DNS-01ACME HTTP-01 vs DNS-01ACME HTTP-01 proves domain control with a token on port 80; DNS-01 uses a TXT record. AutoSSL on our cPanel plans uses HTTP-01, so a CDN that blocks…Updated Aug 29, 2026
  12. Certificate chain and intermediatesCertificate chain and intermediatesBrowsers need your leaf certificate plus intermediates—the certificate chain—to reach a trusted root. Serving only the leaf can work on one device and fail on another.Updated Aug 29, 2026
  13. OCSP staplingOCSP staplingOCSP stapling lets your server send the CA’s revocation answer in the TLS handshake so clients need not contact the CA. LiteSpeed can staple when outbound access works;…Updated Aug 29, 2026
  14. Wildcard certs on cPanelWildcard certs on cPanelA wildcard certificate covers *.example.com but not the apex. AutoSSL cannot issue one over HTTP-01. Learn when separate DV certificates are simpler on cPanel.Updated Aug 29, 2026
  15. SSL Labs grades, used carefullySSL Labs grades, used carefullySSL Labs rates your hostname’s TLS setup. An A is a practical goal; A+ mostly adds HSTS. Use the report after the certificate works, and fix chain issues…Updated Aug 29, 2026
  16. Expired certificate: the five-minute versionExpired certificate: the five-minute versionAn expired certificate needs a reissue, not a reboot. Confirm the dates, fix DNS or port 80 for AutoSSL, retry once, or install a paid cert while clients…Updated Aug 29, 2026
  17. SNI and the default vhostSNI and the default vhostSNI lets one IP serve many certificates because the client sends the hostname in the handshake. The default vhost answers when no name is sent, so keep it…Updated Aug 29, 2026
  18. Force HTTPS in WordPress without a plugin pileForce HTTPS in WordPress without a plugin pileForce HTTPS in WordPress by setting siteurl and home to https://, then adding one server redirect. Fix mixed content with search-replace, not extra plugins.Updated Aug 29, 2026
  19. HSTS preload is a trap until it is notHSTS preload is a trap until it is notHSTS preload puts your domain in the browser binary. Do not submit during a migration. Start with a small max-age, and treat removal as slow.Updated Aug 29, 2026
  20. Private key hygiene for certificatesPrivate key hygiene for certificatesYour private key is the secret behind the certificate. Keep it 0640, off git and tickets, and reissue whenever it may have leaked.Updated Aug 29, 2026
  21. Check whether your site uses post-quantum TLSCheck whether your site uses post-quantum TLSSee whether your site negotiates post-quantum TLS by reading the TLS 1.3 group name. Your certificate can stay classical while browsers use a hybrid key exchange.Updated Aug 29, 2026