Free SSL Setup on cPanel and DirectAdmin

This updated guide explains Let’s Encrypt setup and automatic renewal in cPanel and DirectAdmin. A free SSL certificate can protect HTTPS traffic, but reliable operation also needs domain validation, correct deployment and monitoring. We distinguish current control-panel screens from older instructions, and cover DNS, CDN and renewal failures for shared hosting, VPS and dedicated server deployments. Confirm the panel version, account permissions and management service scope before making changes.

HTTPS protects traffic between TLS endpoints; it does not prove that a business is trustworthy or that an application is secure. Browser connection indicators vary, so inspect connection details instead of relying on a particular lock icon. Let’s Encrypt removes the certificate issuance fee for its DV certificates. It does not remove hosting, integration or monitoring costs, and HTTPS alone does not guarantee search rankings.

Let’s Encrypt solves this problem by issuing domain-validated (DV) certificates for free and automating most of the process through the ACME protocol. When you connect Let’s Encrypt with your control panel correctly, your server can request, install and renew certificates without manual intervention. A compatible control panel can centralize certificate issuance and renewal instead of requiring custom scripts. For a self-managed server, configuring and monitoring that automation remains the operator’s responsibility unless a separate management service is agreed.

How Let’s Encrypt and ACME Work (In Plain Language)

To get a certificate from Let’s Encrypt, your server must prove that it really controls a domain. This happens via the ACME (Automatic Certificate Management Environment) protocol. In simple terms:

The ACME client requests a certificate for the names it needs, such as example.com and www.example.com.
The CA validates control through a supported challenge, such as an HTTP response or a DNS TXT record, subject to its issuance rules.
Domain validation is separate from deploying the resulting certificate on every TLS endpoint.
As of 4 November 2026, Let’s Encrypt documents classic certificates at 90 days, tlsserver at 45 days and shortlived at 160 hours. Orders without a profile request use classic; profile selection depends on client/server support.
Inspect actual notBefore/notAfter dates. Do not assume either panel supports every profile or that every certificate has a 90-day lifetime.

On cPanel and DirectAdmin, you rarely deal with raw ACME commands. Instead, the panel includes (or can be extended with) an ACME client which talks to Let’s Encrypt on your behalf. When correctly configured, this same client also schedules automatic renewals, usually through cron or the panel’s own task scheduler. If you want to dive deeper into challenge types and edge cases, our article ACME Challenges Deep Dive: HTTP-01, DNS-01, and TLS-ALPN-01 explains what happens under the hood.

Pre‑Checklist: Things to Fix Before Issuing Any Certificate

Before you click any “Issue SSL” button in cPanel or DirectAdmin, spend a couple of minutes checking the basics. DNS and hosting misconfigurations can prevent certificate issuance or renewal.

1. Make sure DNS points to the right server

For HTTP-01 challenges, Let’s Encrypt must be able to reach the challenge response over HTTP on port 80. That means:

For direct hosting, A and any AAAA answers must reach endpoints that serve the correct challenge. A wrong IPv6 response can fail validation despite working IPv4.
With a CDN, verify the actual challenge route rather than requiring public DNS to expose the origin IP.
Compare authoritative DNS with external resolver answers. Cached earlier data may persist according to TTLs; there is no single global moment when every cache has updated.

If you are not sure about DNS records, our guide DNS Records Explained Like a Friend walks through A, AAAA, CNAME and other records with practical examples.

2. Avoid conflicting CAA records (or configure them properly)

CAA records let you restrict which certificate authorities (CAs) are allowed to issue certificates for your domain. They are useful for security, but misconfigured CAA records can block issuance by Let’s Encrypt. If you have CAA records, ensure the applicable policy authorizes Let’s Encrypt (for example, issue “letsencrypt.org”) and that any account or validation-method restrictions match your ACME setup. If no applicable CAA policy restricts issuance, CAA will not block the request, but the other issuance checks must still pass.

For advanced multi-CA setups, we recommend reading our deep dive into CAA records and multi-CA strategies before you tighten restrictions.

3. Ensure HTTP (port 80) is reachable

Many people try to force HTTPS immediately with redirects that break the validation path. A good rule:

HTTP to HTTPS redirects are good, but they must still allow ACME challenge URLs to be served correctly.
Keep port 80 reachable while using HTTP-01 challenges. DNS-01 validates through DNS instead.

If a CDN or reverse proxy fronts the site, the requested HTTP-01 response must be served correctly along that route. It need not always be served directly by the origin, but panel-managed challenges commonly depend on reaching the panel’s response. DNS-01 has different requirements: the authoritative TXT response and the automation that updates it.

4. Plan your HTTP to HTTPS migration

First verify a valid HTTPS connection for each hostname. Then test permanent redirects, application URLs and mixed content; stage HSTS only after HTTPS and renewal monitoring work. The title of our Full HTTPS Migration Guide: 301 Redirects, HSTS and Zero-Loss SEO describes a migration goal, not a guarantee of zero SEO impact. TLS terminated at a proxy requires a redirect design that understands that topology.

Step‑by‑Step: Free SSL and Auto‑Renew on cPanel

The exact screens you see can differ slightly depending on how your hosting provider configures cPanel, but the overall process is similar. Confirm whether AutoSSL is enabled for your account before relying on automatic issuance; pointing DNS correctly is only one prerequisite.

1. Check if AutoSSL is enabled in WHM (server admins)

If you are managing your own VPS, dedicated server or colocation machine with WHM:

Open WHM → SSL/TLS → Manage AutoSSL with appropriate administrator permissions.
Check Current Provider. Current documentation names Let’s Encrypt as the default; it is the only AutoSSL provider in cPanel & WHM 120 and later.
Review the provider terms and save the intended setting. Recreating a working ACME registration is not a routine prerequisite.
Check the account’s feature list and Manage Users overrides: enabled, disabled or reset to the feature-list setting.
Use the per-user Check or Run AutoSSL for All Users only for the scope you intend to inspect. A run does not guarantee immediate issuance.

Once configured, AutoSSL can issue and renew certificates for enabled, eligible accounts without extra scripting, provided domain validation continues to succeed.

2. Check AutoSSL coverage for a cPanel account (end users)

Check both account eligibility and the domain’s inclusion status. Current cPanel may show a standalone SSL/TLS Status page or a Status tab inside SSL/TLS Certificates. The unified tab hides AutoSSL actions. The standalone page can show them when the provider enables SSL Host Installer and AutoSSL features and selects Let’s Encrypt.

Open the standalone Security → SSL/TLS Status page when available.
Inspect domain status, certificate details and errors. If you only have the unified Status tab, ask the provider to confirm action access and account configuration.
Where AutoSSL actions are exposed, select the domain rows, then click Include during AutoSSL. A checked row alone does not change inclusion.
Exclude during AutoSSL removes selected names from automation; verify the resulting Included/Excluded status.
Use Run AutoSSL for an immediate check when permitted, then inspect its result. Scheduled checks run during nightly system updates and after account creation through the task queue.

Read the Certificate Status details and last run information; do not assign universal meanings to icon colours. A valid installed certificate, an included domain and a successful new request are separate states. Verify the certificate actually served over HTTPS too, especially when a CDN presents a different edge certificate.

3. Add Domains and Check Their Certificate Coverage

Addon and parked domains are often forgotten during SSL setup, which leads to browser warnings when users access the site from alternate URLs. To include them:

Use Domains → Create a New Domain in the current interface, reviewing document-root and sharing settings. Addon Domains and Aliases are legacy separate interface names.
Prepare the relevant DNS and challenge route; root, www and other names may have different destinations.
Return to SSL/TLS Status and inspect the new domain’s inclusion and validation status.
Where permitted, include the intended names and run AutoSSL, or inspect the next scheduled check. Confirm actual certificate SAN coverage afterward.

An alternate plugin screen is not interchangeable with every built-in AutoSSL interface. Follow documentation for the installed version. For HTTP-to-HTTPS redirection, current Domains documentation offers Force HTTPS Redirect for a Main Domain with a valid certificate and hides the toggle for aliases. Verify the actual HTTP status and Location target. Avoid duplicating panel, proxy and application redirects.

4. Confirming that auto-renew is working on cPanel

A scheduled AutoSSL check and a renewal threshold are different. The current cPanel SSL guide describes its documented AutoSSL flow as 90-day certificates and Let’s Encrypt renewal attempts within 29 days of expiry. This is product-specific behavior, not a universal rule for all ACME clients or Let’s Encrypt profiles. A fresh certificate should not change every night.

Record the certificate’s actual names and validity dates, then monitor renewal eligibility and the next check.
Inspect WHM → Manage AutoSSL → Logs when a renewal is due or a domain has an error; a single quiet cycle proves little.
After successful issuance, verify the new certificate on the actual web/mail endpoint rather than assuming a particular server reload sequence.
Treat replacement of non-AutoSSL certificates as a separate setting; avoid unexpectedly replacing a paid OV/EV certificate with DV.

Keep account eligibility, DNS control and challenge access working. Configure panel notifications deliberately; they can be disabled or restricted. Let’s Encrypt ended its own expiration notification emails on 4 June 2025, so an ACME contact address is not an expiry-monitoring strategy. Use independent endpoint monitoring with warning time appropriate to the certificate lifetime.

Step‑by‑Step: Free SSL and Auto‑Renew on DirectAdmin

Current DirectAdmin documentation uses User Level → SSL Certificates → ACME settings for domain automation. Older skins may show “Free & automatic certificate from Let’s Encrypt”. Match the instructions to the installed version; the screen and renewal algorithm have changed.

1. Enable Let’s Encrypt at the admin level (server admins)

If you manage your own DirectAdmin server:

Check the installed DirectAdmin version and supported ACME configuration.
Confirm that the server’s letsencrypt support and the user’s access are enabled. The documented global default is enabled, but a provider may configure account access differently.
Verify the intended CA, DNS integration, accurate system time and certificate notification settings.
Keep a record of the domain’s existing certificate and working configuration before changing automation. Do not assume a generic Administrator Settings checkbox exists in every skin.

Confirm the actual service arrangement with your hosting provider. A self-managed server requires someone to maintain its panel, ACME integration and monitoring. The presence of a panel or a hosting brand does not by itself establish that these operations are included as a managed service.

2. Requesting a Let’s Encrypt certificate for a single domain

As a DirectAdmin user (for example, on a shared hosting account or a user under a reseller):

Select the intended user and domain, then open SSL Certificates → ACME settings.
Enable the domain’s ACME automation and select Let’s Encrypt as the provider where offered.
Review required names such as example.com and www.example.com; add mail or application names only when that endpoint is part of the intended service.
Prepare HTTP-01 access or a supported DNS-01 integration, save the settings and use the available on-demand provisioning action if needed.
Inspect the resulting certificate and HTTPS response. Do not apply old private_html symlink instructions automatically: DirectAdmin stopped using that directory in web configurations in 1.695 and stopped creating it in 1.711. Inspect custom or older document roots before changing files.

The validation method depends on the configuration. HTTP-01 needs the correct response on its HTTP route; DNS-01 needs the authoritative TXT response. A successful panel result is only one check: confirm certificate names, chain and dates at each endpoint, including a separate CDN edge where applicable.

3. Enabling auto-renew in DirectAdmin

DirectAdmin 1.711 changed renewal calculations from a fixed number of remaining days to a fraction of certificate lifetime. The current default threshold is 65% used lifetime, with default jitter spreading it across roughly 60–70%. Installed versions and administrator settings can differ. Its documented 24-hour automatic processing cycle does not mean every certificate is reissued every day.

Confirm that domain ACME automation remains enabled and inspect current request results.
At the 65% central threshold, a 90-day certificate reaches renewal at 58.5 days and a 45-day certificate at 29.25 days. Jitter and scheduling make these examples, not guaranteed timestamps.
Current acme_disable_after_failures defaults to 5 failures before disabling automation; inspect both errors and enablement.
Keep the actual validation route and web hosting configuration coordinated when moving DNS or servers.

Use the supported ACME settings and logs for the installed version. Do not add a competing cron renewal job merely because one check did not change the expiry date. After correcting a failed validation or disabled workflow, verify issuance and the certificate actually served to clients.

4. Using Let’s Encrypt for multiple domains and subdomains

A certificate can contain multiple DNS names, but panel grouping, validation and CA/profile limits determine the result. Do not assume every name in an account is covered by one certificate. Inspect the final Subject Alternative Name list and keep existing required names when changing coverage.

Open the relevant domain’s SSL Certificates and ACME settings.
Review the required root, www and application hostnames and their actual services.
Check validation for every requested name and the panel’s certificate grouping.
Save the intended configuration and inspect issuance results and final SANs. Repeatedly reissuing unchanged certificates can encounter limits.

Let’s Encrypt wildcards require DNS-01. A name such as *.example.com covers one label below example.com; it does not cover the root or a.b.example.com. Current DirectAdmin supports listed remote DNS providers through SSL Certificates → Manage ACME DNS Providers in Evolution. For the documented wildcard workflow, an administrator must also verify that wildcard certificate support is enabled through dns_ttl=1 in directadmin.conf. cPanel’s Let’s Encrypt wildcard plugin instead requires local or cluster-managed DNS and does not support third-party DNS for that workflow. Use least-privilege DNS credentials. Our The Hands-Off Guide to Let’s Encrypt Wildcard SSL and DNS-01 automation discusses other DNS-01 arrangements.

Verifying HTTPS, Auto‑Renew and Common Pitfalls

Once your certificate is issued, you should test it thoroughly to avoid surprises later.

1. Basic browser checks

Open your site in a modern browser and check:

Open each expected HTTPS hostname and inspect connection details without assuming a lock icon is present in every browser.
Check the certificate SANs, issuer, chain and actual validity dates.
Compare those dates with the selected profile and panel behavior, rather than expecting 90 days in every case.
Test HTTP redirects and separate CDN/origin endpoints. A certificate is not a page-cache object; purging a CDN cache does not by itself deploy a new certificate.

2. Detect and fix mixed content

Mixed content happens when a page is loaded over HTTPS but some resources (images, scripts, CSS files) are still loaded over HTTP. Browsers may block or warn about these resources, making the site look broken. To avoid this:

Replace hard-coded HTTP resource URLs with working HTTPS URLs; prefer explicit HTTPS over protocol-relative URLs.
Update CMS URL settings only after HTTPS works, retaining a recovery path for administration.
Use browser Network and Console tools to locate blocked or insecure resources.
If TLS terminates at a proxy and the origin receives HTTP, a redirect based only on the origin’s HTTPS flag can loop. Cloudflare Flexible is one example. Configure the proxy/origin TLS and redirect policies together.

For a deeper look at SSL-related warnings, including mixed content and “Not secure” labels, see our guide Fixing Common SSL Certificate Errors: Mixed Content, ‘Not Secure’ and Browser Warnings.

3. Confirming renewals actually happen

It is easy to set everything up once and then forget about it until the day a certificate expires. To avoid this:

Monitor the certificate actually served at each public TLS endpoint, with alerts early enough for its lifetime and your response time.
Track successful requests and changes in actual validity dates; do not expect renewal to add a fixed 90 days to the old expiry.
If renewal is due but has not succeeded, inspect cPanel AutoSSL or DirectAdmin ACME logs and whether automation has been disabled.
Test notification delivery. A reminder one week before expiry is unsuitable for a certificate whose entire lifetime is shorter than a week.

Common reasons for failed renewals include moved DNS, disabled virtual hosts, changed document roots or a firewall that suddenly blocks port 80.

4. Pay attention when you change DNS or hosting

Before moving DNS or hosting, prepare certificate issuance and deployment on the destination. HTTP-01 follows the public request route; DNS-01 follows the authoritative DNS record, so “renewal targets the new hosting IP” is not true for every method. Different www/root destinations can work if each validates correctly. A newly selected VPS or dedicated server does not automatically have working ACME automation.

Our Why Domain Transfers Break Email (and How to Avoid It) discusses migration planning. Certificate continuity additionally needs a tested destination TLS endpoint, a working challenge path and monitoring during the cutover. Changing a DNS TTL does not make all earlier cached data disappear immediately.

When You Might Still Need a Paid SSL Certificate

A DV certificate can meet many website TLS needs, but certificate selection should follow documented client, contractual and identity requirements. A certificate alone does not establish e-commerce or PCI DSS compliance. Consider commercial options when they provide a specific capability you need:

Required organizational identity validation through OV or EV, where the relying application or policy actually uses it.
A specific CA, client compatibility requirement or integration supported by the service.
Contracted support, certificate management or another clearly defined operational feature.
Separate private-PKI requirements for a closed environment. Do not assume buying a public certificate avoids public-trust lifetime limits or the need for renewal automation.

Encryption depends on the negotiated TLS configuration, keys and algorithms, rather than whether the certificate was free. DV, OV and EV differ in identity validation; modern browser indicators should not be assumed to display a prominent EV company badge. Let’s Encrypt vs Commercial SSL: Choosing the Right Certificate for E‑Commerce and Enterprise compares the selection criteria. Keep application and payment-security controls separate from certificate purchase.

Keep HTTPS and Certificate Renewal Under Observation

On cPanel, verify the provider, user feature permissions, domain inclusion and actual AutoSSL results. On DirectAdmin, verify domain ACME settings and the renewal algorithm for the installed version. In both cases, test the challenge route, final certificate SANs, HTTPS endpoints and redirects. Healthy DNS alone does not establish that every certificate is installed or will renew.

Before selecting a DCHost plan or another hosting service, confirm who maintains the panel, ACME credentials, notifications and incident response. Separate server hosting from managed administration. Recheck the full path after domain, DNS, CDN or application changes, and keep monitoring active so a failed renewal can be addressed before users encounter certificate errors.