AutoSSL for Resellers: Free HTTPS on Every Client Site, Forever

Not long ago, resellers sold SSL certificates as a lucrative add-on. Today a missing padlock gets a site labeled Not Secure and quietly buried by search engines, and free automated certificates have become table stakes. Here is how AutoSSL works on your reseller plan and how to handle its occasional tantrums.

What AutoSSL does

AutoSSL, built into cPanel/WHM, requests a free domain-validated certificate for every domain on every account, installs it, and renews it before expiry, all with zero human involvement. Client adds a domain today; it has working HTTPS within the hour. On WebsNP reseller plans it is enabled by default for all accounts.

DV certificates are enough for almost everyone

AutoSSL issues domain-validated certificates: they prove domain control and encrypt traffic, and the browser padlock looks identical to expensive alternatives. Organization-validated and extended-validation certificates still exist for banks and enterprises with compliance checklists; your bakery, school and consultancy clients need exactly none of that. Sell peace of mind, not certificate tiers.

Why AutoSSL sometimes fails to issue

Every reseller eventually sees a red AutoSSL warning. Nearly every case is one of these:

  • DNS does not point here. The domain still points at the old host, or the client changed records. Validation requires the domain to actually resolve to your server. Fix the DNS, re-run AutoSSL.
  • Domain expired. More common than anyone admits. Check the registration before debugging anything else.
  • A stray subdomain in the account. An old dev.clientsite.com that points nowhere can fail validation noisily while the main site is fine. Exclude dead subdomains or delete them.
  • .htaccess blocking validation. Aggressive security rules or a coming-soon plugin blocking the /.well-known/ path. Whitelist it.
  • Rate limits. Rare, transient; retry the next day.

Forcing HTTPS once the certificate exists

A certificate does not redirect anyone. Clients still reaching http:// need a redirect to https://, done per-site in .htaccess or with one toggle in WordPress SSL plugins. Include this in your site-launch checklist, along with fixing mixed-content warnings (hardcoded http:// images and scripts) which are the number one reason a padlock shows broken after everything else worked.

Start Your Hosting Business with WebsNP Reseller Hosting

NVMe SSD reseller plans with WHM, cPanel accounts for your clients, free SSL for every site, private nameservers, and a support team that answers when your client is shouting. Pay in NPR or USD.

See Reseller Hosting Plans

The reseller's SSL policy in one paragraph

Every plan includes free SSL, automatically, forever; that sentence goes on your website and closes deals against resellers still charging for certificates. Behind the scenes: AutoSSL on for everyone, force-HTTPS at site launch, and a monthly glance at WHM's AutoSSL log so you fix the odd DNS-based failure before a client sees a warning. Total ongoing effort: minutes a month. Perceived professionalism: enormous.