How to Install SSL in cPanel

Free vs paid SSL in cPanel — what you need

SSL in cPanel is the certificate bound to a domain on that account. AutoSSL asks a certificate authority, often Let's Encrypt, for a domain-validated certificate and installs it when the name points at this server. A paid certificate is the CRT, private key, and CA bundle you paste yourself.

Linux hosting here includes Let's Encrypt in cPanel. This site does not offer free web hosting. Windows hosting uses Plesk, so these clicks do not apply there.

Sectigo Positive SSL is ₹1,800 a year before 18% GST and covers www plus the bare name of one domain. The wildcard is ₹7,500 a year before 18% GST. Both figures were read from the billing list on 30 October 2026.

Order a paid certificate from SSL certificates when you need a one-year term or a wildcard. AutoSSL stays the path for a normal domain-validated padlock.

A purchased certificate does not make the connection stronger than Let's Encrypt. It changes the term, the names covered, and which authority issues the file.

Method 1 — AutoSSL (Let's Encrypt) in three steps

Log in on the hostname from your welcome mail. The usual cPanel address uses port 2083. Use AutoSSL when a domain-validated padlock is enough and the A record already points at this server.

1. Confirm the domain points at this server — an A record to the server IP, because validation proves domain control over this server.
2. Run AutoSSL — cPanel → SSL/TLS Status → select the domain → Run AutoSSL. Let's Encrypt issues in minutes.
3. Force HTTPS — Domains → toggle Force HTTPS Redirect beside the domain.

AutoSSL renews the certificate while that DNS check still passes. Let's Encrypt lasts about 90 days, and the panel reissues it before expiry. If the run fails, use the DCV list below.

On a WebJi® account the button is in your own panel on cPanel hosting, not in the server-admin WHM screen.

Method 2 — install a purchased certificate (CSR plus CRT)

Use this path when a certificate authority has already issued a certificate, or when that authority still needs a certificate signing request from this server.

1. Create the CSR only if the authority still needs one. Open Security, then SSL/TLS, then Generate, view, or delete SSL certificate signing requests. Use at least 2,048 bits, the exact hostname, and the location and organisation the authority asked for. Copy the block from BEGIN CERTIFICATE REQUEST through END CERTIFICATE REQUEST. Leave the private key on this server.
2. Open the install screen. After the files arrive, go to Install and Manage SSL for your site, also labelled Manage SSL sites.
3. Paste the three parts. Select the domain. Paste the certificate into the CRT box, including the BEGIN and END lines. If the request was made here, use Autofill by Domain so the private key fills in. Paste the CA bundle if that box is empty.
4. Install and check. Click Install Certificate. Load the hostname with https://. The install worked when the browser shows a padlock and SSL/TLS Status marks that domain secured.

The usual files are certificate.crt, ca_bundle.crt, and private.key. If the key was created on another machine, paste that key. Do not generate a fresh CSR after the certificate is issued, or the key and the CRT will not match.

Method 3 — wildcard SSL via DNS validation

A wildcard uses a name such as *.example.com. The bare domain is covered only when that name is also on the certificate.

An HTTP check can see only hosts the authority can fetch, so a wildcard is usually proved with a DNS TXT record. After it is issued, install the CRT, key, and bundle on the same screen as a single-name certificate.

AutoSSL on a shared account does not replace a paid wildcard. On WebJi® the Sectigo wildcard is ₹7,500 a year before 18% GST, read on 30 October 2026. Install it on the cPanel account that serves the site.

Forcing HTTPS and fixing mixed content

A certificate can be installed while visitors still open http://. In cPanel go to Domains, find the domain, and switch on Force HTTPS Redirect.

If the padlock is still missing, open the page source and search for http:// on images, stylesheets, and scripts. Point those URLs at https://. On WordPress, set both the WordPress address and the site address to https:// so the editor stops writing http links.

If the warning remains after the redirect and that source check, follow SSL not working.

AutoSSL failed — DCV errors and fixes

AutoSSL fails when it cannot prove you control the domain. Fix the cause, then run it again from SSL/TLS Status and read the line for that domain.

• Domain not pointing to the server — the A record still aims at old hosting. Fix the DNS first; AutoSSL retries on the next cycle.
• Cloudflare proxy (orange cloud) intercepting validation — pause the proxy or use a DNS-based validation method.
• CAA records blocking Let's Encrypt — the domain's CAA record lists authorised CAs; add letsencrypt.org or remove the restriction.
• WWW and non-www mismatch — both hostnames need valid DNS; AutoSSL covers both only when both resolve.
• A rewrite or a password rule hiding the check — turn that rule off, run AutoSSL, then turn the rule back on.

On a WebJi® account, email that log to support@webji.services. The office phone is not the support line.

Renewal — how AutoSSL keeps certificates alive

Let's Encrypt through AutoSSL is replaced before the 90-day end while domain control still checks out. You do not upload a new CRT for that renewal. The clock is explained on Let's Encrypt auto-renew.

A one-year purchased certificate is not renewed by AutoSSL. Before it expires, renew it at the authority and paste the new CRT and bundle on the install screen. Keep the same private key if the authority reused the CSR.

If the padlock vanishes, open SSL/TLS Status. A red row means the certificate is missing or expired. A green row with a browser warning is usually mixed content, or a hostname the certificate does not list.