Free AutoSSL certificate in cPanel: check it, reissue it, fix errors
PrintIn short: on TopHost shared hosting you do not need to buy or install a certificate to have HTTPS. The AutoSSL service in cPanel issues a free certificate for every domain in your account as soon as the domain points to our server, and renews it on its own before it expires. The state of each certificate is shown in cPanel under Security, then SSL/TLS Status, and if a certificate is missing or has expired, you can start AutoSSL again from there, usually within a few minutes.
What AutoSSL protects
- the main domain of the account, addon domains, subdomains and their
wwwvariants; - the service names cPanel uses, such as
mail.domain.mdorwebmail.domain.md, when they point to the server; - all of this at no cost, on every shared hosting plan, renewals included.
Free certificates are valid for a limited period, but you do not have to track it: renewal happens automatically as long as the domain still points to us.
What the domain needs for a certificate
- It is registered and active. An expired or suspended domain cannot be validated.
- Its DNS leads to our server. Either the domain uses the TopHost nameservers
ns4.tophost.mdandns5.tophost.md, or, if the DNS is managed elsewhere, the A records of the domain and ofwwwhold the IP address of your hosting server. - The DNS change has spread. A new domain or new nameservers usually work within a few hours, normally within 24-48 hours at most. Before that, validation fails.
- The validation check can reach the site. The check reads a small file from the domain's folder over HTTP. A password on the whole folder, a blocking or redirect rule in
.htaccess, or a firewall rule on Cloudflare can stop it.
Checking the certificate and running AutoSSL again
- Sign in to cPanel through the client area: open My Services, pick the hosting plan and use the cPanel login button.
- In the Security section, click SSL/TLS Status. You will see every name in the account with the state of its certificate.
- Look at the lines of your domain, usually
domain.mdandwww.domain.md. A green padlock with the note AutoSSL Domain Validated means the certificate is valid. Any other state, for example a self-signed or expired certificate, comes with a short message about what went wrong. - To start a new attempt now, click Run AutoSSL. The run takes from a few seconds to a few minutes.
- Reload the page. A red message spells out exactly what stopped the issuance; the usual causes and their fixes follow below.
When AutoSSL fails: causes and fixes
In the browser, the sign is usually a "Your connection is not private" warning or a struck-through padlock: the website has no valid certificate, either because it was never issued or because it has run out.
The domain's DNS leads somewhere else
Before issuing anything, AutoSSL confirms over the internet that the domain answers from our server. If the old nameservers are still in place or the A record leads to another IP, the check fails. Correct the nameservers (by default ns4.tophost.md and ns5.tophost.md) using Change nameservers for .MD, .COM and other domains.
DNS was changed only recently
After moving a domain or switching nameservers, the new data spreads gradually, occasionally over as long as 72 hours. AutoSSL retries on its own from time to time, but you can press Run AutoSSL again as soon as the website loads from our server.
A redirect or a protection gets in the way
A plugin or .htaccess rule that insists on HTTPS while there is still no certificate, or a folder locked with a password, can keep the validation file out of reach. Switch the rule or plugin off for a moment, run AutoSSL, then turn it back on.
The domain runs through Cloudflare
With the Cloudflare proxy turned on, validation may never reach our server, and with SSL set to "Flexible" or "Off" the connection to the server can break too. The settings that work with AutoSSL are in the Cloudflare guide for TopHost hosting.
The domain has expired
An expired or suspended domain cannot pass validation. Renew it in the client area, under Domains, then run AutoSSL again.
Leaving a name out of AutoSSL
Some names do not point to our server on purpose, for example a subdomain that runs on another service. AutoSSL will keep failing for them. Tick such names in the list and click Exclude Domains from AutoSSL; the button Include Domains during AutoSSL brings them back. Remember that an excluded name gets no free certificate.
Once the certificate is active
- Send every visitor to the secure version with an HTTP to HTTPS redirect, either in the .htaccess file, or with Force HTTPS Redirect or redirects in cPanel.
- In WordPress, check under Settings, then General, that both site addresses start with
https://. - If the certificate is valid but the padlock is missing, or the browser says the page is "not fully secure", some images, styles or scripts are still loaded over
http://. Replace those addresses withhttps://in your content, theme or plugin settings. - You can check the expiry date at any time by clicking the padlock in the address bar and opening the certificate details.
Other situations
cPanel or webmail opened by IP address shows a warning
Certificates are issued for names, never for an IP address. Open cPanel and webmail by the server name from your hosting activation e-mail, or by your own domain once its certificate is valid.
You need a certificate with company validation
For an organisation-validated certificate or a warranty, order a paid one: see ordering and configuring a paid SSL certificate. A valid certificate that you installed yourself is not overwritten by AutoSSL.
Questions clients ask
Does the free certificate cost anything later?
No. It is part of every TopHost shared hosting plan, renewals included.
I added a new domain. Do I have to do anything?
No. Once the domain points to the server, AutoSSL picks it up on its next run. To speed things up, click Run AutoSSL yourself.
Does AutoSSL work on a VPS?
AutoSSL is part of cPanel. On a server without cPanel, use an ACME client instead, for example as shown in Install ACME for Apache and NGINX.
When to contact us
If the domain has pointed to our server for at least a day, you have run AutoSSL and there is still no certificate, open a ticket. Paste the error text from SSL/TLS Status into your message so we can go straight to the AutoSSL log.
