How to Install a Free SSL Certificate in cPanel (Generator, DNS Method and AutoSSL)

To get a free SSL certificate in cPanel, you have two routes: let the hosting issue it with AutoSSL, or create a Let's Encrypt certificate yourself with a free SSL generator and paste it into cPanel. Both give your site the padlock and https://.

I have used both on many sites. AutoSSL is the easy one when it works. When it does not, a free SSL generator like PunchSalad (or ZeroSSL and similar tools) gets the job done in about 10 minutes. This guide covers the setup, the copy mistakes that break the install, the DNS cases where verification fails, and the AutoSSL tricks I use when the certificate refuses to appear.

Quick checklist: free SSL in cPanel

1. First try AutoSSL in cPanel (SSL/TLS Status > Run AutoSSL). If it works, you are done.
2. If not, open a free SSL generator, enter your domain, and choose HTTP or DNS verification.
3. Add only the domain names that really exist in DNS (root, and www only if it has a record).
4. Verify, then copy the private key immediately. It is shown only once.
5. In cPanel, go to SSL/TLS > Manage SSL sites and paste the CRT, private key and CA bundle.
6. Force HTTPS on the site and set a reminder to renew before the certificate expires.

Which free SSL method should you use?

How to generate a free SSL certificate (PunchSalad or similar)

These generators all work the same way, because they use Let's Encrypt (or ZeroSSL) behind the scenes:

1. Open the generator and enter your domain name.
2. Enter an email for expiry notices, if it asks.
3. Choose the verification method: HTTP (upload a file) or DNS (add a TXT record).
4. Complete the verification (below), and click Verify or Next.
5. The generator shows three boxes: the certificate, the private key and the CA bundle. Copy them.

Which domain names should you add?

This is where many verifications fail. The generator checks every name you add, and if one fails, the whole certificate fails.

• domain.com: add it always.
• www.domain.com: add it only if www has its own DNS record (an A record or a CNAME). On many sites, only the main domain has a record in DNS. If you add both and www has nothing, the generator cannot verify it, and you get an error even though the main domain is fine.

Check in the DNS zone (or with a DNS lookup) whether www exists. If it does not, either add a record for it first, or generate the certificate for the main domain alone.

How to verify the domain with the HTTP method

The HTTP method proves you control the website by putting a small file on it.

1. The generator gives you one file per domain name, with a long random name, and its content.
2. In cPanel File Manager, open the site's root folder (public_html, or the add-on domain's folder).
3. Create the folders .well-known and inside it acme-challenge (turn on Show Hidden Files to see dot-folders).
4. Upload or create the file inside acme-challenge with exactly the name and content given.
5. Open the file's link in a browser (the generator shows it). If you see the text, click Verify.

Why the HTTP method often fails

In my experience the HTTP method fails more often than it works. The usual reasons:

• the domain does not point to this hosting yet, or the DNS has not updated;
• the file was saved in the wrong folder (a different domain's folder, or public_html instead of the add-on domain's root);
• .htaccess redirects or a security plugin block the .well-known folder;
• Cloudflare or another proxy sits in front of the site;
• the file name or content has an extra space or line break;
• the uploaded file is a duplicate download like filename (1), or a file from an earlier attempt.

When it keeps failing, don't fight it: switch to the DNS method.

How to verify the domain with the DNS method

The DNS method proves you control the domain by adding a TXT record. It does not need the website to be online at all.

1. The generator gives you a record name, usually _acme-challenge (and _acme-challenge.www for www), and a long value.
2. Open the DNS settings where the domain's DNS is actually managed.
3. Add a TXT record with that name and value. Some panels want only _acme-challenge, others want the full _acme-challenge.domain.com, so follow what the panel shows for other records.
4. Wait a few minutes, then click Verify. If it fails, wait 10 to 15 minutes and try again; DNS needs time to update.

Add the TXT record where the DNS really is

This one cost me time on a real project. The client's site had been on Wix, and I redesigned it on cPanel hosting. The website now lived on cPanel, so I added the TXT record in cPanel's Zone Editor. Verification failed again and again.

The reason: the domain was still registered on Wix, and its nameservers still pointed to Wix. The hosting only received an A record pointing to it. cPanel's DNS zone was not the live DNS at all. I added the same TXT record in Wix's DNS settings, and verification passed on the next try.

The general rule: add DNS records where the domain's nameservers point, not where the website is hosted. That might be:

• the registrar (Namecheap, GoDaddy, Wix, Hostinger and so on), if you kept their default nameservers;
• Cloudflare, if the nameservers are Cloudflare's;
• your hosting's Zone Editor, only if the domain uses the hosting's nameservers.

Look up the domain's nameservers (any WHOIS or DNS lookup shows them) before adding the record.

How to copy the certificate without mistakes

Most failed installs I have seen are copy mistakes, not certificate problems.

Copy the private key straight away

The private key is created once and shown once. Many generators do not keep it, so if you close or refresh the page, it is gone, and the certificate is useless without it. Copy it the moment it appears, and save all three parts in a text file on your computer. Keep that file private: anyone with the key can impersonate your site.

Check where one certificate ends and the next begins

Every certificate is a block that starts and ends like this:

-----BEGIN CERTIFICATE-----
MIIFLjCCBBagAwIBAgISA...
...
-----END CERTIFICATE-----

Some generators, especially for certificates with several domain names, give you the certificate and the CA bundle combined in one box. Before pasting, scroll through or drag down the text and look for each -----END CERTIFICATE----- followed by a new -----BEGIN CERTIFICATE-----:

• the first block is your domain's certificate: it goes in the CRT field;
• the blocks after it are the CA bundle (the intermediate certificates): they go in the CABUNDLE field.

Copy the whole block every time, including the dashed BEGIN and END lines, with no missing characters at the start or end. The private key block starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY) and must never go in the certificate fields.

How to install the certificate in cPanel

1. In cPanel, open SSL/TLS (under Security) and click Manage SSL sites.
2. Under Install an SSL Website, pick the domain.
3. Paste the certificate into Certificate (CRT).
4. Paste the private key into Private Key (KEY).
5. Paste the CA bundle into Certificate Authority Bundle (CABUNDLE).
6. Click Install Certificate.

If you paste only the certificate, the Autofill by Certificate button can fill in the key and bundle, as long as the key is already stored in cPanel. With generator certificates it usually is not, so paste all three by hand.

cPanel shows an error if the key does not match the certificate. That almost always means the wrong key, or a block that was cut off while copying.

How to fix AutoSSL when the certificate does not appear

If your host offers AutoSSL, it is the best option, because it renews by itself. When a domain stays on "not secure", these are the steps I try.

Run AutoSSL for the domain

1. In cPanel, open SSL/TLS Status.
2. Tick the domains (both domain.com and www.domain.com, if www exists).
3. Click Run AutoSSL and wait a few minutes, then reload the page.

The page shows why a domain failed, for example a DNS that does not point to this server. Fix that, then run it again.

Remove a wrong certificate first

Sometimes the domain already has the wrong certificate: an expired one, a self-signed one, or one issued for another name, such as cpanel.domain.com or a different domain on the same account. AutoSSL may then leave it alone.

1. Go to SSL/TLS > Manage SSL sites. At the bottom, the list shows every domain with its installed certificate.
2. Find your domain and click Uninstall, then confirm.
3. Optionally, in SSL/TLS > Certificates (CRT), delete the old certificate too.
4. Go back to SSL/TLS Status, select the domain, and Run AutoSSL again.

In most cases, the right certificate shows up within a few minutes.

A trick that worked for me: change the key type and switch it back

In cPanel, go to SSL/TLS and open Default SSL/TLS Key Type (on some hosts, such as GoDaddy, it sits on the SSL/TLS page itself). It lists about four options, like:

• RSA, 2,048-bit (usually the default);
• RSA, 4,096-bit;
• ECDSA, P-256;
• ECDSA, P-384.

On a few sites where AutoSSL would not issue, I selected another option, clicked Update, then selected the default (RSA, 2,048-bit) again and updated once more. Changing the key type makes cPanel request new certificates, and the SSL came on within minutes.

The same trick also updates a certificate that is already installed: if the site has an old, expired or wrong SSL that AutoSSL is not replacing, switching the key type and back makes cPanel issue a fresh one in its place.

It is a workaround, not an official fix, so try the steps above first. But it is harmless to try when nothing else moves.

After installing SSL: force HTTPS

A certificate alone does not send visitors to https://. Once the padlock works:

• In cPanel, open Domains and turn on Force HTTPS Redirect for the domain, if your cPanel has it.
• Or add a redirect at the top of .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [L,R=301]

• On WordPress, change both addresses in Settings > General to https://.
• If the padlock shows a warning, the page still loads some images or files over http:// (mixed content). Replace the old links with a search-replace plugin, as explained in my migration guide.

Then open the site in a private window and click the padlock to check the certificate's name and expiry date.

Common free SSL errors and fixes

Frequently asked questions

Is a free SSL certificate as secure as a paid one?

Yes, for encryption. A free Let's Encrypt certificate encrypts the connection just like a paid one. Paid certificates add things like organisation validation, a warranty and longer validity, which most small sites do not need.

How long does a free SSL certificate last?

Certificates from Let's Encrypt last about 90 days. AutoSSL renews them for you; certificates from a generator website must be renewed by hand.

Do I need a certificate for both domain.com and www.domain.com?

Only if visitors can reach both. If www has a DNS record, include it so https://www. works too. If it has none, the certificate for the main domain is enough, and adding www will only make verification fail.

Why does the HTTP method fail when the site is online?

Usually because the domain points somewhere else than you think (a proxy, an old host), or because a redirect or security rule blocks the .well-known folder. The DNS method avoids all of this.

Where do I find the private key if I lost it?

If the generator did not save it and cPanel does not have it under SSL/TLS > Private Keys, it cannot be recovered. Generate a new certificate and copy the key this time.