How to Install an SSL Certificate in WHM
To install an SSL certificate in WHM, open SSL/TLS » Install an SSL Certificate on a Domain, enter the domain, and paste the certificate, private key and CA bundle. For free certificates use Manage AutoSSL, whose default Let's Encrypt provider renews automatically. WHM and mail warnings need Manage Service SSL Certificates instead.
For WHM administrators on a VPS or dedicated server who need websites, the panel and mail all served without certificate warnings.
knowledge
- Read time
- 5 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Which WHM SSL route do you need: AutoSSL, a purchased certificate or service SSL?
WHM installs certificates in three different places, and mixing them up is why people install a certificate and still see a warning. A domain certificate covers a website, a service certificate covers the panel and mail server, and AutoSSL issues domain certificates automatically.
| Route | WHM screen | Use it when |
|---|---|---|
| AutoSSL | SSL/TLS, then Manage AutoSSL | You want free domain certificates that renew themselves |
| Purchased certificate | SSL/TLS, then Install an SSL Certificate on a Domain | You need a wildcard, OV or EV certificate, or AutoSSL cannot validate the domain |
| Service SSL | SSL/TLS, then Manage Service SSL Certificates | The WHM login, cPanel login, mail, FTP or Dovecot still shows a warning |
WHM runs on port 2087 and cPanel on 2083, and both use their own hostname certificate. Installing a certificate on a customer domain does nothing for those two, which is the single most common misunderstanding about this screen.
How to install a purchased SSL certificate on a domain in WHM
The domain field decides which virtual host receives the certificate. Get that value exactly right, including the www prefix if the certificate covers it, and paste all three parts.
- Log in to WHM and open SSL/TLS, then Install an SSL Certificate on a Domain.
- Type the domain in the Domain field. If the certificate was issued for www.example.com and example.com, both names must appear in its SAN list.
- Paste the server certificate, the private key, and the CA bundle into their boxes. If the CSR was created on this server, click Autofill by Certificate after pasting the certificate to fill the other two.
- For a certificate that is already on the server, click Browse Certificates, select it, then click Use Certificate.
- Click Install, then load the domain over https and confirm the issuer and expiry in the browser's certificate viewer.
WHM stores the files under /var/cpanel/ssl/apache_tls/ and rebuilds the Apache configuration itself. There is no need to edit a VirtualHost by hand for a domain certificate, and doing so risks WHM overwriting the change on the next rebuild. The same certificate on a single account can also be installed from cPanel, as in installing SSL in cPanel.
How to generate a CSR inside WHM
A CSR made in WHM keeps the private key on the server, which removes the most common cause of a failed install: a key that exists only on someone's laptop.
- Open SSL/TLS, then Generate an SSL Certificate and Signing Request.
- Enter the domain, choose a 2048-bit key, and fill the organisation fields. For a domain-validated certificate these fields are not verified, but they must still be filled.
- Submit, then copy the CSR text and paste it into the certificate order.
- When the certificate arrives, return to the install screen and use Autofill by Certificate; WHM finds the matching key from the CSR record.
If the CSR was generated elsewhere and the private key was not saved, the certificate cannot be installed. Reissue rather than searching for a workaround, because a certificate and key must pair exactly.
How to turn on AutoSSL in WHM and read a failure
AutoSSL issues a free certificate per domain and renews it before expiry. Enable it once and check that every domain is covered, rather than trusting the default.
- Open SSL/TLS, then Manage AutoSSL. Choose a provider and click Save. Let’s Encrypt is the default provider, is included free with the cPanel licence, and supports wildcard domains. Accept the provider’s Terms of Service when prompted.
- Click Run AutoSSL for All Users once, or run
/usr/local/cpanel/bin/autossl_check --allas root. After that, AutoSSL runs during the nightlyupcpupdate and after each new account is created. - Read the Logs tab. The files are stored as text and JSON in
/var/cpanel/logs/autossland kept for 30 days; each domain gets a line explaining success, a deferral or the exact validation failure. - Test a fix for one account with the Check button on the Manage Users tab instead of waiting for the nightly run. Leave “Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates” off if anyone uses paid OV or EV certificates, because it can swap them for DV certificates within three days of expiry.
Domain control validation is where AutoSSL fails. A domain whose DNS still points at an old host cannot be validated, and a CAA record that names a different certificate authority blocks issuance outright. Both are visible in the log as a named reason, not as a generic error. Browser-side symptoms after a successful issue are covered in SSL not working.
How to secure WHM, cPanel, mail and FTP with service certificates
Those warnings on port 2087 and in mail clients are the service certificate, not the website certificate. Replace it once and every panel, mail, and FTP connection on the hostname stops warning.
Open SSL/TLS, then Manage Service SSL Certificates. Each service has its own row: the WHM and cPanel service, the mail server, Dovecot, and FTP. Install a certificate for the server hostname on the services you expose, then restart those services when WHM prompts you.
Use a certificate that covers the hostname itself, such as server.example.com, rather than a customer domain. Confirm the result by loading https://server.example.com:2087 and checking that the certificate name matches the hostname.
How to force HTTPS after installing a certificate in WHM
Installing a certificate does not redirect anything. The switch is per domain in cPanel, not in WHM, and cPanel only offers it once the domain has a valid certificate.
- Log in to the account’s cPanel, open Domains, and turn on the Force HTTPS Redirect toggle for each domain that should never serve plain HTTP.
- Test with
curl -I http://example.comand confirm a 301 to the https address, then test a subdomain that has no certificate separately. - Load a page with images and scripts and check the browser console. Mixed content means an asset is still hard-coded to http, which a redirect cannot fix.
The redirect applies to web traffic only. Mail clients connecting over IMAP or SMTP are unaffected, so a mail certificate warning is a service certificate job, covered above.
Why WHM rejects an SSL certificate and how to fix it
The install screen is specific when it fails. Read the message, fix the input, and install again rather than editing Apache directly.
| Message | Cause | Fix |
|---|---|---|
| The certificate is not valid for the domain | The domain is not in the certificate's SAN list | Reissue to include that name, or install against the name the certificate covers |
| The private key does not match the certificate | Key and certificate came from different CSRs | Install the key generated with that CSR, or reissue |
| AutoSSL failed: DCV prevented | DNS points elsewhere, or a CAA record names another CA | Fix the A record or the CAA record, then run AutoSSL for that user |
| Certificate installed, browser still warns | The CA bundle is missing or the wrong service | Paste the full bundle, and check whether the warning is on 2087 rather than the website |
| Site loads on http after install | No redirect is configured | Turn on Force HTTPS Redirect in cPanel » Domains |
Which WebJi® SSL certificate fits a WHM server?
Sectigo Positive SSL covers one domain with its www name for ₹1,800 a year and the wildcard covers a domain and all its subdomains for ₹7,500 a year, both before 18% GST in WebJi®’s published pricing. Checkout confirms the final amount. Both are domain-validated; the types of SSL certificates explains when OV or EV is worth it. Both certificates can be installed on this screen with the certificate, key, and bundle you receive.
If the server itself is the bottleneck, WebJi® cPanel VPS servers ship with WHM and root access, and configurations are quoted by email at support@webji.services before payment. Support is 24/7 by email in Hindi and English, with an average first reply under 60 minutes. Certificate types and renewal terms sit on the SSL certificate page.
Sources: cPanel & WHM documentation, “Manage AutoSSL” (docs.cpanel.net/whm/ssl-tls/manage-autossl/, last modified 8 July 2026), “Install an SSL Certificate on a Domain” and “Manage Service SSL Certificates”.
Frequently asked questions
How do I install an SSL certificate in WHM?
Open SSL/TLS, then Install an SSL Certificate on a Domain. Enter the domain, paste the certificate, private key and CA bundle, then click Install. If the CSR was generated on the server, Autofill by Certificate fills in the key and bundle for you.
How does AutoSSL issue free certificates?
AutoSSL runs on a schedule, proves control of each domain through a DNS or HTTP check, requests a certificate from the configured provider, and installs it. It renews before expiry and reports every outcome in the Logs tab, stored in /var/cpanel/logs/autossl for 30 days.
Why does AutoSSL keep failing for one domain?
Domain control validation is failing. The usual causes are DNS still pointing at another host, a CAA record that names a different certificate authority, or a domain that has no DNS zone on the server. The log names which one applies.
How do I remove the certificate warning from the WHM login?
That warning is the service certificate, not the domain certificate. Open SSL/TLS, then Manage Service SSL Certificates, install a certificate for the server hostname on the WHM, cPanel, mail and FTP services, and restart them when prompted.
How do I generate a CSR in WHM?
Open SSL/TLS, then Generate an SSL Certificate and Signing Request. Enter the domain and organisation details, submit, and copy the CSR into your certificate order. WHM keeps the matching private key, so the install screen can autofill it later.
Does installing a certificate force HTTPS automatically?
No. The certificate only makes https possible. Turn on the Force HTTPS Redirect toggle in cPanel » Domains for each domain after the certificate works, and check subdomains and mail hostnames separately before enabling it for them.
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.