How to Install an SSL Certificate in WHM

Which of the three WHM routes you need

WHM installs certificates in three different places, and mixing them up is why people install a certificate and still see a warning. A domain certificate covers a website, a service certificate covers the panel and mail server, and AutoSSL issues domain certificates automatically.

WHM runs on port 2087 and cPanel on 2083, and both use their own hostname certificate. Installing a certificate on a customer domain does nothing for those two, which is the single most common misunderstanding about this screen.

Install a purchased certificate on a domain

The domain field decides which virtual host receives the certificate. Get that value exactly right, including the www prefix if the certificate covers it, and paste all three parts.

1. Log in to WHM and open SSL/TLS, then Install an SSL Certificate on a Domain.
2. Type the domain in the Domain field. If the certificate was issued for www.example.com and example.com, both names must appear in its SAN list.
3. Paste the server certificate, the private key, and the CA bundle into their boxes. If the CSR was created on this server, click Autofill by Certificate after pasting the certificate to fill the other two.
4. For a certificate that is already on the server, click Browse Certificates, select it, then click Use Certificate.
5. Click Install, then load the domain over https and confirm the issuer and expiry in the browser's certificate viewer.

WHM stores the files under /var/cpanel/ssl/apache_tls/ and rebuilds the Apache configuration itself. There is no need to edit a VirtualHost by hand for a domain certificate, and doing so risks WHM overwriting the change on the next rebuild.

Generate the CSR inside WHM

A CSR made in WHM keeps the private key on the server, which removes the most common cause of a failed install: a key that exists only on someone's laptop.

1. Open SSL/TLS, then Generate an SSL Certificate and Signing Request.
2. Enter the domain, choose a 2048-bit key, and fill the organisation fields. For a domain-validated certificate these fields are not verified, but they must still be filled.
3. Submit, then copy the CSR text and paste it into the certificate order.
4. When the certificate arrives, return to the install screen and use Autofill by Certificate; WHM finds the matching key from the CSR record.

If the CSR was generated elsewhere and the private key was not saved, the certificate cannot be installed. Reissue rather than searching for a workaround, because a certificate and key must pair exactly.

Turn on AutoSSL and read a failure

AutoSSL issues a free certificate per domain and renews it before expiry. Enable it once and check that every domain is covered, rather than trusting the default.

• Open SSL/TLS, then Manage AutoSSL. Enable AutoSSL and pick a provider; the cPanel-provided provider works without extra setup, and Let's Encrypt is available if you prefer it.
• Set the renewal lead time so certificates renew roughly a month before expiry, then run AutoSSL for all users once to populate the queue.
• Read the log at /usr/local/cpanel/logs/autossl.log. Each domain gets a line explaining success, a skipped state, or the exact validation failure.
• Run AutoSSL for one user from the same screen when you are testing a fix, instead of waiting for the nightly run.

Domain control validation is where AutoSSL fails. A domain whose DNS still points at an old host cannot be validated, and a CAA record that names a different certificate authority blocks issuance outright. Both are visible in the log as a named reason, not as a generic error.

Secure WHM, cPanel, mail and FTP with service certificates

Those warnings on port 2087 and in mail clients are the service certificate, not the website certificate. Replace it once and every panel, mail, and FTP connection on the hostname stops warning.

Open SSL/TLS, then Manage Service SSL Certificates. Each service has its own row: the WHM and cPanel service, the mail server, Dovecot, and FTP. Install a certificate for the server hostname on the services you expose, then restart those services when WHM prompts you.

Use a certificate that covers the hostname itself, such as server.example.com, rather than a customer domain. Confirm the result by loading https://server.example.com:2087 and checking that the certificate name matches the hostname.

Force HTTPS without breaking mail or subdomains

Installing a certificate does not redirect anything. WHM has a switch for that, and it should be turned on only after the certificate is confirmed working on each domain.

1. Open SSL/TLS, then Force HTTPS Redirect, and enable it for the domains that should never serve plain HTTP.
2. Test with curl -I http://example.com and confirm a 301 to the https address, then test a subdomain that has no certificate separately.
3. Load a page with images and scripts and check the browser console. Mixed content means an asset is still hard-coded to http, which a redirect cannot fix.

Leave mail hostnames out of the redirect until their service certificate is installed, or clients that connect on the plain hostname will fail after the change.

When WHM rejects the certificate

The install screen is specific when it fails. Read the message, fix the input, and install again rather than editing Apache directly.

Certificates and servers from WebJi

Sectigo Positive SSL covers one domain with its www name for ₹1,800 per year before 18% GST, and the wildcard covers a domain and all subdomains for ₹7,500 per year before GST. Both are issued as DV certificates and can be installed on this screen with the certificate, key, and bundle you receive.

If the server itself is the bottleneck, our cPanel VPS servers ship with WHM and root access, and configurations are quoted by email at support@webji.services before payment. Support is 24/7 by email in Hindi and English, with an average first reply under 60 minutes. Certificate types and renewal terms sit on the SSL certificate page.