Free SSL with AutoSSL: How It Works and How to Fix It Print

Every domain and subdomain on your EDZNET hosting gets a free SSL certificate through cPanel's AutoSSL, so your site loads over HTTPS with a padlock. This article explains how it works and what to do when a domain shows as insecure or a certificate hasn't appeared.

How AutoSSL works

• AutoSSL checks your account regularly and issues a certificate for each domain, subdomain and common extra name (such as www.example.co.uk) that it can verify.
• To verify a domain, its DNS must point to our server. A new domain, or one whose nameservers you've just changed, won't get a certificate until DNS has updated.
• Certificates renew automatically before they expire. You don't need to do anything while DNS keeps pointing to us.

Most new domains get a certificate within a few hours of DNS pointing to us. It can sometimes take up to 24 hours.

Check the status and run AutoSSL

1. Log in to cPanel and open Security › SSL/TLS Status.
2. Each domain is listed with its certificate status. A green padlock means it's covered; a red or yellow icon means there's no valid certificate, or one is about to expire.
3. Click Run AutoSSL to make cPanel try again straight away. It takes a minute or two, then the page shows the result.
4. If a domain still isn't covered, click View log (or the status message next to the domain) to see why it failed.

Include or exclude a domain

On the same page, tick the domains you want to change and click Exclude Domains from AutoSSL or Include Domains during AutoSSL. Exclude a name only if you deliberately don't want a certificate for it, for example a subdomain that points elsewhere or one covered by a paid certificate. Domains are included by default, so you can include a name you excluded by mistake again.

Common reasons AutoSSL fails

• DNS doesn't point to us. The domain's nameservers or A record still point to another provider. Check with our DNS checker, and see pointing your domain to EDZNET.
• A name has no DNS record. If www.example.co.uk or a subdomain doesn't resolve, AutoSSL skips it. Add the missing record, or exclude the name.
• Cloudflare is proxying the domain. With the orange cloud on, our server may not be able to complete validation. See using Cloudflare with your EDZNET hosting.
• CAA records. A CAA record limits which certificate authorities can issue for your domain. If you've added one and it doesn't permit the authority AutoSSL uses, issuing fails. Remove the CAA record, or ask support which authority to allow.
• Redirects or .htaccess rules that block requests to /.well-known/ can stop the validation check reaching your site.

Once AutoSSL succeeds, check the result with our SSL checker. Then force HTTPS so visitors always get the secure version. If the browser still shows a warning, SSL certificate errors explained covers the usual causes. If the log shows an error you can't fix, open a ticket and paste in the message.