🔒 SSL Certificates

How to Install an SSL Certificate on cPanel

Learn how to install a free or paid SSL certificate on your cPanel hosting account. This guide covers AutoSSL, Let Encrypt, and manual SSL installation.

📅 22 March 2026 🔄 Updated 04 April 2026 ⏱ 16 min read 👁 48 views

Introduction to SSL Certificates

An SSL (Secure Sockets Layer) certificate is a digital certificate that encrypts data transmitted between your website and its visitors. In today's internet landscape, having an SSL certificate is not just recommended—it's essential for security, SEO rankings, and user trust.

This comprehensive guide will walk you through everything you need to know about installing SSL certificates on cPanel hosting, from understanding SSL basics to troubleshooting common installation issues.

What is an SSL Certificate and Why Do You Need It?

SSL/TLS (Transport Layer Security) certificates create an encrypted connection between a web server and a browser, ensuring that all data passed between them remains private and secure. When you visit a website with SSL, you'll see a padlock icon in the address bar and the URL begins with "https://" instead of "http://".

Key Benefits of SSL Certificates

Data Encryption: Protects sensitive information like passwords, credit card numbers, and personal data from interception
Authentication: Verifies that visitors are connecting to your legitimate website, not an imposter site
Trust and Credibility: Modern browsers display warnings for non-HTTPS sites, which can scare away visitors
SEO Benefits: Google ranks HTTPS websites higher than HTTP sites in search results
Compliance: Required for PCI DSS compliance if you process credit card payments
Browser Compatibility: Many modern web features require HTTPS to function

Types of SSL Certificates

Domain Validated (DV): Basic validation, verifies domain ownership only. Free options like Let's Encrypt fall into this category
Organization Validated (OV): Moderate validation, verifies organization identity. Good for business websites
Extended Validation (EV): Highest validation level, displays organization name in the address bar. Ideal for e-commerce and financial sites
Wildcard SSL: Secures a domain and all its subdomains (e.g., *.yourdomain.com)
Multi-Domain SSL: Secures multiple different domains with a single certificate

Prerequisites Before Installing SSL

Before you begin the SSL installation process, ensure you have:

cPanel Access: Login credentials for your cPanel hosting account
Domain Access: Your domain must be pointed to your hosting server (DNS properly configured)
Valid Domain: The domain must be active and resolving correctly
Email Access: Access to an email address at your domain for verification (for some SSL types)
Dedicated IP: Some older SSL types require a dedicated IP address (most modern certificates don't)

Method 1: Using AutoSSL (Let's Encrypt) - Recommended

AutoSSL is the easiest and most popular method for installing free SSL certificates on cPanel. It uses Let's Encrypt, a free, automated, and open Certificate Authority that provides trusted SSL certificates.

Advantages of AutoSSL

Completely free forever
Automatic installation and renewal
No configuration required
Trusted by all major browsers
Covers both www and non-www versions of your domain

Step 1: Enable AutoSSL

Log into your cPanel account
Scroll down to the Security section
Click on SSL/TLS Status
You'll see a list of your domains and their current SSL status
Check the boxes next to the domains you want to secure
Click Run AutoSSL at the top of the page

Step 2: Wait for Installation

AutoSSL will automatically:

Verify your domain ownership
Generate SSL certificates
Install certificates on your domains
Configure automatic renewal (certificates renew every 90 days)

The process typically takes 5-10 minutes. You can monitor progress in real-time on the SSL/TLS Status page.

Step 3: Verify Installation

Once AutoSSL completes:

Visit your website using https://yourdomain.com
Check for the padlock icon in your browser's address bar
Click the padlock to view certificate details
Verify the certificate is issued by "Let's Encrypt Authority"

Troubleshooting AutoSSL

If AutoSSL fails, common causes include:

DNS not propagated: Wait 24-48 hours after pointing your domain to the server
CAA records blocking Let's Encrypt: Check your DNS CAA records and ensure Let's Encrypt is allowed
.htaccess redirect issues: Temporarily rename .htaccess to .htaccess-backup and retry
Cloudflare or CDN: Temporarily pause Cloudflare proxy or CDN during installation

Method 2: Manual SSL Certificate Installation

If you've purchased a commercial SSL certificate from a provider like Comodo, DigiCert, or GeoTrust, you'll need to install it manually. This method also applies if AutoSSL isn't available on your hosting plan.

Step 1: Generate a CSR (Certificate Signing Request)

Log into cPanel
Navigate to Security → SSL/TLS
Click Generate, view, or delete SSL certificate signing requests
Fill in the form with your information:

Key: Leave as default (2048-bit)
Domains: Enter your domain (e.g., yourdomain.com)
City: Your city name
State: Your state or province
Country: Two-letter country code (e.g., US, UK, IN)
Company: Your company or organization name
Company Division: Department (optional)
Email: Administrative contact email
Passphrase: Leave blank unless required

Click Generate
Copy the generated CSR code (the long text block beginning with "-----BEGIN CERTIFICATE REQUEST-----")

Step 2: Purchase and Validate Your SSL Certificate

Submit your CSR to your SSL certificate provider
Complete the domain validation process (varies by provider):

Email validation: Receive and click a verification link sent to admin@yourdomain.com
DNS validation: Add a TXT record to your domain's DNS
File validation: Upload a verification file to your website

Wait for certificate issuance (can take minutes to hours depending on validation type)
Download your certificate files (typically includes certificate.crt, ca_bundle.crt, and private.key)

Step 3: Install the SSL Certificate

Return to cPanel → Security → SSL/TLS
Click Manage SSL sites
Select your domain from the dropdown menu
Paste your certificate files into the corresponding fields:

Certificate (CRT): Paste the content of your .crt file
Private Key (KEY): Paste your private key (generated during CSR creation, or provided by your SSL provider)
Certificate Authority Bundle (CABUNDLE): Paste the CA bundle or intermediate certificate

Click Install Certificate
You should see a success message confirming installation

Step 4: Verify Manual Installation

Visit https://yourdomain.com in your browser
Click the padlock icon to view certificate details
Verify the certificate is issued by your chosen provider
Check the expiration date and ensure it matches your purchase

Method 3: Using Free SSL Providers

Besides Let's Encrypt (via AutoSSL), several other providers offer free SSL certificates. However, most require manual installation and renewal.

Free SSL Certificate Providers

Let's Encrypt: Most popular, automated via AutoSSL
ZeroSSL: Free 90-day certificates with manual installation
Cloudflare: Free SSL when using their CDN service (flexible or full SSL)
SSL For Free: Web-based tool for generating Let's Encrypt certificates

Installing Certificates from Alternative Providers

The installation process is similar to Method 2:

Generate a CSR in cPanel (or use the provider's tool)
Validate your domain with the provider
Download your certificate files
Install via cPanel → SSL/TLS → Manage SSL sites
Paste certificate, private key, and CA bundle
Click Install Certificate

Installing SSL for Subdomains

Securing subdomains requires additional steps:

Option 1: AutoSSL for Subdomains

Go to cPanel → SSL/TLS Status
Find your subdomain in the list
Check the box next to it
Click Run AutoSSL
Wait for automatic installation

Option 2: Wildcard SSL Certificate

A wildcard SSL certificate (*.yourdomain.com) secures all current and future subdomains:

Purchase a wildcard certificate from a provider
Generate CSR with domain as *.yourdomain.com
Complete validation and download certificate
Install via cPanel SSL/TLS Manager

Option 3: Individual Certificates per Subdomain

Follow the same process as main domain installation, but specify the subdomain (e.g., blog.yourdomain.com) when generating CSR and installing certificate.

Forcing HTTPS Across Your Entire Website

After installing SSL, you need to redirect all HTTP traffic to HTTPS to ensure visitors always use the secure connection.

Method 1: Using cPanel's Force HTTPS Redirect

Log into cPanel
Go to Domains section
Click Domains
Find your domain and click Manage
Toggle Force HTTPS Redirect to ON
Save changes

Method 2: Manual .htaccess Redirect

If your cPanel doesn't have the Force HTTPS option, manually edit your .htaccess file:

Connect to your site via FTP or cPanel File Manager
Navigate to your public_html directory
Edit the .htaccess file (create one if it doesn't exist)
Add this code at the very top of the file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Save the file
Test by visiting http://yourdomain.com (should redirect to https://)

Method 3: WordPress-Specific HTTPS Configuration

For WordPress sites, additional steps ensure full HTTPS implementation:

Log into WordPress admin dashboard
Go to Settings → General
Update WordPress Address (URL) from http:// to https://
Update Site Address (URL) from http:// to https://
Save changes
Install a plugin like "Really Simple SSL" for comprehensive HTTPS conversion

Verifying SSL Installation

After installing SSL, thoroughly test your implementation to ensure everything works correctly.

Visual Browser Check

Visit your website using https://
Look for the padlock icon in the address bar
Click the padlock to view certificate details
Verify the certificate is valid and matches your domain

SSL Testing Tools

Use these professional tools to check your SSL configuration:

SSL Labs Server Test: Visit ssllabs.com/ssltest/ and enter your domain. Aim for an A or A+ rating
Why No Padlock: Identifies mixed content issues (whynopadlock.com)
SSL Checker: Verifies certificate installation and chain (sslshopper.com/ssl-checker.html)
GeoCerts SSL Checker: Checks certificate validity and configuration

Check for Mixed Content

Mixed content occurs when your HTTPS site loads HTTP resources (images, scripts, stylesheets). This triggers browser warnings:

Open your website in Chrome or Firefox
Press F12 to open Developer Tools
Click the Console tab
Look for "Mixed Content" warnings
Update all HTTP:// references to HTTPS:// or use protocol-relative URLs (//example.com/image.jpg)

Understanding SSL Certificate Expiration and Renewal

Certificate Validity Periods

Let's Encrypt / AutoSSL: 90-day validity, auto-renews every 60 days
Commercial DV Certificates: Typically 1-2 years
Commercial OV/EV Certificates: Usually 1-2 years

AutoSSL Automatic Renewal

AutoSSL handles renewal automatically:

Checks certificate status daily
Renews certificates 30 days before expiration
No action required from you
Sends email notifications if renewal fails

Manual Certificate Renewal

For manually installed certificates:

Set a calendar reminder 30 days before expiration
Purchase renewal from your SSL provider
Generate new CSR (or reuse existing private key)
Complete validation process
Download new certificate
Install via cPanel SSL/TLS Manager

Monitoring Certificate Expiration

Use these tools to track certificate expiration:

cPanel SSL/TLS Status: Shows expiration dates for all certificates
SSL Certificate Monitor: Free monitoring services send expiration alerts
Browser extensions: Tools like "SSL Certificate Checker" monitor sites you visit

Troubleshooting Common SSL Issues

SSL Certificate Not Trusted / Invalid Certificate Error

Possible causes:

Certificate expired
Incomplete certificate chain (missing CA bundle)
Wrong certificate installed
Self-signed certificate being used

Solutions:

Check expiration date in cPanel SSL/TLS Status
Reinstall certificate with correct CA bundle
Verify certificate matches your domain exactly
Use AutoSSL instead of self-signed certificates

Mixed Content Warnings

Symptoms:

Padlock icon shows as "Not Secure" or with warning
Browser console shows mixed content errors
Some resources don't load

Solutions:

Update all hardcoded HTTP:// URLs to HTTPS://
Use protocol-relative URLs (//example.com instead of http://example.com)
Update WordPress plugins and themes
Use "Better Search Replace" plugin to update database URLs in WordPress
Check external resources (fonts, CDNs, APIs) support HTTPS

Certificate Name Mismatch

Error message: "The certificate is not valid for yourdomain.com"

Causes:

Visiting www.yourdomain.com but certificate only covers yourdomain.com (or vice versa)
Certificate was issued for different domain
Using wrong certificate

Solutions:

Ensure certificate covers both www and non-www versions
Use AutoSSL which automatically covers both
Purchase SAN (Subject Alternative Name) certificate with both versions
Redirect one version to the other (e.g., www to non-www)

ERR_SSL_PROTOCOL_ERROR

Causes:

SSL not properly configured on server
Conflicting SSL settings
Outdated SSL/TLS protocols enabled
Firewall or antivirus interference

Solutions:

Contact hosting provider to check server SSL configuration
Clear browser cache and cookies
Disable browser extensions temporarily
Check firewall settings aren't blocking SSL
Ensure cPanel has latest SSL/TLS updates

AutoSSL Keeps Failing

Common reasons:

DNS not pointing to correct server
Domain has CAA records blocking Let's Encrypt
Cloudflare or CDN interfering with validation
.htaccess redirects preventing validation
Firewall blocking Let's Encrypt validation servers

Solutions:

Verify DNS A record points to your hosting server IP
Check for CAA records in DNS: dig CAA yourdomain.com
Temporarily pause Cloudflare (set to DNS only, not proxied)
Rename .htaccess to .htaccess-backup temporarily
Check AutoSSL logs in cPanel for specific error messages
Wait 24-48 hours if you recently changed DNS

SSL Works on Desktop but Not Mobile

Causes:

Mobile device has outdated date/time
Mobile browser cache issues
Intermediate certificate not properly installed
Mixed content on mobile version of site

Solutions:

Check device date/time is correct and set to automatic
Clear mobile browser cache
Reinstall certificate with complete CA bundle
Test mobile site on SSL Labs
Check for mobile-specific JavaScript or CSS loading HTTP resources

SSL Best Practices and Security Recommendations

Choose the Right Certificate Type

Personal blogs/portfolios: Free Let's Encrypt DV certificate is sufficient
Business websites: Consider OV certificate for additional verification
E-commerce stores: Use EV certificate for maximum trust indicators
Multiple subdomains: Invest in wildcard certificate
Multiple domains: Use SAN/UCC multi-domain certificate

Enable HSTS (HTTP Strict Transport Security)

HSTS forces browsers to only connect via HTTPS, preventing downgrade attacks:

Add this to your .htaccess file (after HTTPS redirect):

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

This tells browsers to use HTTPS for 1 year (31536000 seconds)
Consider adding your site to the HSTS preload list at hstspreload.org

Disable Weak Protocols and Ciphers

Contact your hosting provider to ensure:

TLS 1.2 and TLS 1.3 are enabled
SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 are disabled (all deprecated)
Weak ciphers are disabled
Forward secrecy is enabled

Regular Security Audits

Run SSL Labs test quarterly to check for new vulnerabilities
Monitor certificate expiration dates
Keep cPanel and server software updated
Review SSL/TLS configuration after server updates

Implement Content Security Policy (CSP)

CSP headers prevent mixed content and XSS attacks. Add to .htaccess:

Header set Content-Security-Policy "upgrade-insecure-requests;"

This automatically upgrades HTTP requests to HTTPS where possible.

Update Internal Links

After installing SSL:

Update all internal links to use HTTPS or relative URLs
Update sitemaps with HTTPS URLs
Update canonical tags to HTTPS versions
Update social media profiles with HTTPS URLs
Inform Google of HTTPS migration via Search Console

SSL for Different cPanel Hosting Environments

Shared Hosting

AutoSSL (Let's Encrypt) is usually available and recommended
Dedicated IP not required for SNI-compatible certificates
Manual installation available if AutoSSL isn't offered
Some hosts may charge extra for SSL support

VPS and Dedicated Servers

Full control over SSL configuration
Can configure AutoSSL for all accounts
Can install custom SSL providers
May need root access for server-level SSL configuration
Consider automating SSL with Certbot for Let's Encrypt

Reseller Hosting

AutoSSL typically enabled for all client accounts
Can install SSL certificates for client domains
May need to enable per-account SSL in WHM
Consider offering SSL as value-added service

Frequently Asked Questions

Is a free SSL certificate as secure as a paid one?

Yes. Let's Encrypt and other free DV (Domain Validated) certificates use the same encryption standards as paid certificates. The main difference is in validation level and warranty/support. For most websites, free SSL is perfectly adequate and secure.

Do I need a dedicated IP address for SSL?

No, not anymore. Modern servers support SNI (Server Name Indication), which allows multiple SSL certificates on a single IP address. SNI is supported by 99%+ of browsers and devices in use today.

Will SSL slow down my website?

Minimal. Modern SSL/TLS implementations have very little performance impact. In fact, HTTPS enables HTTP/2, which often makes sites faster than HTTP. Any microscopic slowdown is far outweighed by security and SEO benefits.

Can I use the same certificate on multiple domains?

Not with a standard single-domain certificate. You need either a SAN/UCC multi-domain certificate or separate certificates for each domain. Wildcard certificates work for multiple subdomains of the same domain.

What happens if my SSL certificate expires?

Browsers will display scary warning messages to visitors, stating the site is "Not Secure" or "Your connection is not private." Most users will leave immediately. AutoSSL prevents this by automatically renewing certificates before expiration.

How do I fix "NET::ERR_CERT_COMMON_NAME_INVALID" error?

This occurs when the certificate's common name doesn't match the domain you're visiting. Ensure your certificate covers both www and non-www versions of your domain, or redirect one to the other. AutoSSL automatically covers both versions.

Can I install SSL on localhost or development sites?

Yes, but you'll need to use self-signed certificates for local development, which will trigger browser warnings. For staging sites on actual domains, you can use AutoSSL or Let's Encrypt normally.

Does SSL certificate affect email?

SSL certificates for web hosting are separate from email SSL certificates. For secure email, ensure your email client uses SSL/TLS connections (ports 465 for SMTP, 993 for IMAP, 995 for POP3) which typically use different certificates managed by your hosting provider.

How do I check when my SSL certificate expires?

In cPanel, go to SSL/TLS Status to see expiration dates for all certificates. You can also click the padlock icon in your browser when visiting your site, or use command line: openssl s_client -connect yourdomain.com:443 | openssl x509 -noout -dates

What is the difference between SSL and TLS?

TLS (Transport Layer Security) is the modern, more secure successor to SSL (Secure Sockets Layer). Although we commonly say "SSL certificate," we're actually using TLS protocols (TLS 1.2 or TLS 1.3). SSL 2.0 and 3.0 are deprecated and insecure.

Conclusion

Installing an SSL certificate on cPanel is a straightforward process that dramatically improves your website's security, trustworthiness, and search engine rankings. With AutoSSL and Let's Encrypt, you can secure your site with a trusted certificate in minutes, completely free, with automatic renewals ensuring you never have to worry about expiration.

For most websites, the AutoSSL method using Let's Encrypt is the optimal choice—it's free, automated, trusted, and requires no maintenance. If you have specific needs requiring commercial certificates (like EV certificates for e-commerce), the manual installation process is equally straightforward.

Remember to:

Force HTTPS across your entire site after installation
Fix any mixed content warnings
Test your SSL configuration with professional tools
Monitor certificate expiration dates
Keep your cPanel and server software updated

With SSL properly configured, your visitors can browse securely, search engines will rank you higher, and you'll have peace of mind knowing sensitive data is encrypted. If you encounter any issues not covered in this guide, don't hesitate to contact your hosting provider's support team for assistance.

Was this article helpful?

← Back to SSL Certificates 📞 Contact Support