Free SSL for Every Client Site: AutoSSL for Resellers, Explained Properly
Reseller hosting accounts running WHM/cPanel almost always have AutoSSL enabled by default, automatically issuing and renewing a free domain-validated SSL certificate (typically via Let's Encrypt or Sectigo) for every domain and subdomain on the account, with no action required from the reseller for the common case. For a reseller managing dozens of client sites, this genuinely eliminates what used to be manual, per-client certificate purchasing and renewal — but understanding what it does and doesn't cover matters when something goes wrong.
What AutoSSL Actually Does
On a check interval (typically daily), AutoSSL scans every domain, subdomain, and configured alias on the server, verifies domain control (usually via a temporary file placed in the webroot or a DNS check), and issues or renews a certificate automatically if one is missing or nearing expiry. No manual CSR generation, no manual renewal reminders, no client-facing action required for the standard case — which is precisely why it's become the default for shared and reseller hosting rather than an optional add-on.
What It Does Not Cover
- Organization or Extended Validation certificates. AutoSSL issues domain-validated (DV) certificates only — confirming the requester controls the domain, not verifying the business behind it. A client needing OV or EV validation (common for e-commerce or financial sites wanting the extra trust signal) needs a separately purchased certificate.
- Domains that fail domain-control validation. If a domain's DNS points elsewhere, or a firewall/CDN blocks the validation file or request, AutoSSL cannot issue a certificate and will keep silently retrying and failing until the underlying block is resolved.
- Wildcard certificates on most default configurations. Covering an unlimited number of subdomains under one certificate typically requires either a specific AutoSSL provider that supports DNS-based wildcard validation, or a manually issued wildcard certificate.
Common Reasons AutoSSL Fails Silently
- DNS pointing away from the server — a domain added to the account but with its actual A record pointing at Cloudflare or another host prevents domain-control validation from completing.
- A conflicting CDN or proxy — Cloudflare's proxy mode, for instance, can intercept the validation request before it reaches the actual server, causing repeated failed attempts.
- Domain-level email misconfiguration — some validation methods send a confirmation to an admin@ or webmaster@ address on the domain; if that mailbox doesn't exist or bounces, validation fails.
- Server hostname or IP recently changed without updating the domain's DNS to match, breaking the file-based validation check.
Checking AutoSSL Status as a Reseller
WHM's "Manage AutoSSL" and the per-account "SSL/TLS Status" page both show current certificate status and, critically, the specific error message from the last failed attempt — reading that error message directly (rather than guessing) is almost always the fastest path to a fix, since it usually names the exact validation step that failed.
When a Paid Certificate Still Makes Sense
For the large majority of client brochure and small business sites, free AutoSSL-issued DV certificates are functionally identical in the browser padlock and encryption strength to a paid certificate — there is no practical security difference for a typical site. Paid OV/EV certificates remain worth it specifically when a client's audience or industry places weight on the visible extra validation, or when a wildcard certificate genuinely simplifies managing a large number of subdomains under one client's brand.
Frequently Asked Questions
Is a free AutoSSL certificate less secure than a paid one?
No — the encryption strength is identical; the difference is purely in what's validated (domain control only, versus business identity for OV/EV), not in how secure the connection itself is.
Why did a client's SSL certificate suddenly show as expired despite AutoSSL being enabled?
Almost always one of the failure causes above blocking a scheduled renewal — check the specific error in WHM's AutoSSL status rather than assuming the feature itself is broken.
Running a reseller account and need AutoSSL configured correctly across all your client domains? See our reseller hosting plans or ask our support team.
