How to Install an SSL Certificate on cPanel: AutoSSL, Manual, and Let's Encrypt

Installing an SSL certificate on cPanel is one of the most common tasks in shared hosting management — and it is also one where a single misconfiguration can leave your website showing a security warning to every visitor. This guide covers all three methods: AutoSSL (the simplest), Let's Encrypt via the cPanel interface, and manual certificate installation for certificates obtained from any CA.

Understanding the Three Methods

cPanel provides multiple paths to installing SSL certificates. The right method depends on your hosting plan and where your certificate comes from:

• AutoSSL — cPanel's built-in automatic SSL system. Runs in the background, issues and renews certificates automatically. Available on most shared hosting plans. Zero configuration required.
• Let's Encrypt via cPanel — Some hosts expose Let's Encrypt as a selectable provider in AutoSSL settings. Functionally similar to AutoSSL but using Let's Encrypt as the issuing CA instead of Sectigo.
• Manual installation — You obtain a certificate from any CA (paid or free) and paste the certificate files directly into cPanel. Required for EV/OV certificates, wildcard certificates, or certificates from a CA your host does not support natively.

Method 1: Using AutoSSL (Recommended for Most Users)

AutoSSL is the easiest option and requires no technical knowledge. It is enabled by default on most cPanel hosting plans.

1. Log in to your cPanel account (usually at yourdomain.com/cpanel or yourdomain.com:2083).
2. In the Security section, click SSL/TLS Status.
3. You will see a list of all domains and subdomains on your account. Domains with active SSL show a green padlock. Domains without SSL show a yellow or red indicator.
4. Select the domains you want to secure and click Run AutoSSL.
5. AutoSSL will attempt to issue and install certificates for the selected domains. This typically takes a few minutes.

Important: AutoSSL only works for domains whose DNS is currently pointing to the hosting server. If your domain uses Cloudflare or another proxy, you may need to temporarily disable the proxy (orange cloud → grey cloud in Cloudflare) during certificate issuance.

Troubleshooting AutoSSL Failures

If AutoSSL fails, check the AutoSSL log in cPanel:

1. Go to Security → SSL/TLS Status
2. Click View AutoSSL Log
3. Look for error messages next to your domain

Common AutoSSL failures and their causes:

• “Could not verify domain control” — The CA cannot reach your domain to verify ownership. Check that your domain DNS is pointing to this server and that your site is reachable via HTTP (port 80 must be open).
• “Rate limit exceeded” — You have hit Let's Encrypt's rate limit of 5 failed validations per domain per hour. Wait 1 hour and retry.
• “CAA record prevents issuance” — Your domain has a DNS CAA record that restricts which CAs can issue certificates for it. Check your DNS CAA records and add an entry for the CA your host uses.

Method 2: Manual SSL Certificate Installation

Use this method when you have obtained a certificate from an external CA — whether that is ZeroSSL, Buypass, a paid CA like DigiCert, or any other provider.

What you need before starting

You will need three things from your CA:

• Certificate file (CRT) — Usually ends in .crt or .pem. Contains your domain's public certificate.
• Private key (KEY) — Generated on your server when you created the CSR (Certificate Signing Request), or provided by the CA tool you used. Never share this file — keep it confidential.
• CA Bundle / Intermediate certificates (CABUNDLE) — The chain of certificates that links your certificate back to a trusted root CA. Without this, some browsers may show a “certificate not trusted” error even with a valid cert.

Installation steps

1. Log in to cPanel.
2. Go to Security → SSL/TLS.
3. Under Install and Manage SSL for your site (HTTPS), click Manage SSL Sites.
4. Scroll down to Install an SSL Website. Select your domain from the dropdown.
5. Paste the contents of your certificate file into the Certificate (CRT) field. Include the full content from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
6. Paste your private key into the Private Key (KEY) field.
7. Paste the CA bundle into the Certificate Authority Bundle (CABUNDLE) field.
8. Click Install Certificate.

After installation, cPanel will show a success message and your domain will be accessible via HTTPS immediately. No server restart is required.

Generating a CSR in cPanel (if needed)

If your CA requires a CSR (Certificate Signing Request) before issuing a certificate, you can generate one directly in cPanel:

1. Go to Security → SSL/TLS
2. Under Certificate Signing Requests (CSR), click Generate, view, or delete SSL certificate signing requests
3. Fill in your domain name and organisation details
4. Click Generate
5. Copy the CSR text and paste it into your CA's certificate request form

The private key is automatically saved by cPanel and will be auto-populated when you install the resulting certificate.

Forcing HTTPS After SSL Installation

Installing SSL does not automatically redirect HTTP visitors to HTTPS. You need to enable this separately:

Option 1: cPanel “Force HTTPS Redirect”

1. Go to Domains in cPanel
2. Find your domain and toggle on Force HTTPS Redirect

Option 2: .htaccess redirect (Apache)

# Add to .htaccess in your website root directory
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Use the cPanel toggle if available — it is cleaner and avoids manually editing .htaccess. The .htaccess method is useful for shared hosting plans that do not have the toggle.

Verifying Your SSL Installation

After installation, always verify the certificate is working correctly:

• Visit SSL Labs (ssllabs.com/ssltest) — run a free test on your domain. A properly configured certificate with a full chain should score A or A+.
• Check the browser padlock — click it and select “Connection is secure” to view certificate details, including the expiry date and issuing CA.
• Verify HTTPS redirect is working — visit your domain with http:// and confirm it redirects to https://.
• Check for mixed content warnings — if your page loads over HTTPS but references images, scripts, or stylesheets over HTTP, browsers will show a warning. Fix by updating all resource URLs to HTTPS.

Renewing SSL Certificates on cPanel

AutoSSL certificates renew automatically — you do not need to do anything. cPanel attempts renewal when a certificate is within 7 days of expiry.

For manually installed certificates, you will need to re-issue from your CA and reinstall using the same process above. Set a calendar reminder for 30 days before the expiry date shown in SSL Labs or your browser certificate details.

Conclusion

SSL installation on cPanel is straightforward once you understand the three methods available. For most shared hosting users, AutoSSL handles everything automatically. For advanced setups — wildcard certificates, external CAs, or custom certificate chains — manual installation takes about five minutes once you have the certificate files ready. Always verify after installation using SSL Labs and check that HTTPS redirect is active.