---
title: Get your free SSL certificate
description: Every cPanel account includes free Let's Encrypt certificates through AutoSSL. Here's what has to be in place and what to do if one doesn't issue.
sidebar:
  order: 2
---

import { Steps, Aside } from '@astrojs/starlight/components';
import Support from '~/content/partials/support-link.mdx';

Your cPanel hosting includes free SSL certificates from **Let's Encrypt**, issued automatically by cPanel's AutoSSL service. There's nothing to buy and nothing to install by hand.

## What has to be true first

AutoSSL can only issue a certificate once both of these are in place:

<Steps>

1. **The domain is added to your cPanel account** — as the primary domain, an addon domain, or a subdomain.

2. **DNS points at our server.** Let's Encrypt validates a certificate by fetching a file from wherever the domain currently resolves. If it still points at your old host, validation fails and no certificate is issued.

</Steps>

Check where a domain currently resolves at [whatsmydns.net](https://www.whatsmydns.net/).

## When it issues

AutoSSL runs on a schedule — **once every 24 hours**. So after adding a domain and pointing DNS at us, a certificate normally appears within a day without you doing anything.

Renewals are automatic too. Let's Encrypt certificates are valid for 90 days and AutoSSL renews them well before expiry, so a working site stays working.

<Aside type="tip">
  Need it sooner than the next daily run? Confirm DNS is pointing at us, then [open a ticket](https://secure.anhonesthost.com/submitticket.php) — we can trigger AutoSSL by hand and usually have the certificate in place shortly after.
</Aside>

## If a certificate doesn't appear

Work through these in order — the first two cover most cases:

- **DNS isn't pointing here yet.** The most common cause by far. Verify at whatsmydns.net that the domain resolves to our server's IP.
- **It hasn't been 24 hours.** Give the scheduled run a chance before assuming something is broken.
- **The domain isn't actually in your account.** Check cPanel → **Domains**. A domain you own but haven't added is invisible to AutoSSL.
- **A redirect is intercepting validation.** Forced redirects — especially domain-wide ones in `.htaccess` — can stop Let's Encrypt from reaching the validation file.
- **CAA records are blocking issuance.** If your DNS has a CAA record naming a different certificate authority, Let's Encrypt is refused. It must permit `letsencrypt.org`.

## Making your site actually use it

An issued certificate doesn't automatically mean visitors get HTTPS. Once it's in place, make sure your site loads over `https://` and redirects visitors from `http://`. In WordPress, that's usually setting both the **WordPress Address** and **Site Address** to the `https://` version under **Settings → General**.

## Related

- [What are my nameservers?](/cpanel/nameservers/)
- [Why is my site getting a 403 error?](/cpanel/fix-a-403-error/)

## Still stuck?

<Support />
