AutoSSL keeps your main domain and the subdomains cPanel already knows about covered with a free certificate, right up until you add a new one — a client subdomain, a staging environment, a per-tenant hostname — and suddenly there's a fresh "Not Secure" warning waiting for you. If you're spinning up subdomains regularly, chasing individual certificates for each one gets old fast. A wildcard certificate for *.yourdomain.com fixes that in one shot, but cPanel's built-in AutoSSL won't hand you one by default. Here's why, and what actually works.
Symptom
You add a new subdomain — say client1.yourdomain.com — and either it sits without a certificate until the next AutoSSL run, or you notice that no matter how many times you click "Run AutoSSL" in cPanel, there's no option to issue one certificate that covers every current and future subdomain automatically. Some hosts also see this: a subdomain used briefly for testing (like dev.yourdomain.com) gets its own separate Let's Encrypt certificate, and a week later a completely unrelated one appears for staging.yourdomain.com — never a single cert that just says *.yourdomain.com.
Cause
AutoSSL in cPanel issues Domain Validated (DV) certificates using the ACME HTTP-01 challenge — it drops a small file on the server and Let's Encrypt (or Sectigo, depending on your provider setting) fetches it over HTTP to confirm you control that exact hostname. That works fine one subdomain at a time, but wildcard certificates require the ACME DNS-01 challenge instead, which means creating a TXT record in DNS rather than serving a file. Standard AutoSSL on shared hosting doesn't do DNS-01, because it has no way to touch your DNS zone. It only knows how to prove control over a hostname it can already reach over HTTP — which rules wildcards out entirely.
If you're on a VPS or dedicated server where you also manage WHM, this changes: WHM (version 82+) can integrate with a handful of DNS providers directly and run DNS-01 validation for you. On plain shared hosting, you're stuck with the manual route below.
Fix
Option 1 — Shared hosting (no WHM/root access)
You'll generate the wildcard certificate somewhere you control DNS, then upload it into cPanel manually. The tool of choice is acme.sh, which supports DNS API plugins for most major DNS providers (Cloudflare, Route53, GoDaddy, and dozens more).
- On any machine with internet access — your laptop, a small VPS, even a free cloud shell — install acme.sh:
curl https://get.acme.sh | sh - Export your DNS provider's API credentials as environment variables. For Cloudflare, for example:
export CF_Token="your-api-token" - Issue the wildcard certificate:
acme.sh --issue --dns dns_cf -d yourdomain.com -d '*.yourdomain.com' - acme.sh creates the TXT record itself, waits for propagation, and validates automatically. You'll end up with a certificate, private key, and CA bundle in
~/.acme.sh/yourdomain.com/. - In cPanel, go to SSL/TLS > Manage SSL sites (sometimes labeled "Install an SSL Certificate on a Domain"), pick your domain, and paste in the certificate, private key, and CA bundle contents.
- Click Install Certificate. Every current and future subdomain under that domain will now serve over HTTPS using the wildcard, as long as it's on the same cPanel account.
Option 2 — VPS/WHM with root access
If you manage WHM yourself, you don't need to leave cPanel at all. WHM can request wildcard AutoSSL certificates natively once you connect it to your DNS provider:
- In WHM, go to SSL/TLS > Manage AutoSSL > DNS Providers.
- Add your provider's API credentials (Cloudflare and Amazon Route53 are the most commonly supported).
- Once connected, AutoSSL can run DNS-01 validation and issue wildcard certificates for domains hosted with that provider, renewing them automatically like any other AutoSSL certificate.
This is the cleaner long-term setup if you're already running your own VPS, since it removes the manual renewal step entirely.
Stop AutoSSL from overwriting your wildcard
One catch that trips people up: even after you install a wildcard manually, cPanel's AutoSSL will still try to issue and install its own single-domain certificate on its next scheduled run, silently replacing your wildcard. To stop that:
- In cPanel, go to SSL/TLS Status under the Security section.
- Find the domain and uncheck it (or use the "Exclude" option) so AutoSSL skips it on future runs.
- If you manage WHM, you can also exclude the domain account-wide under WHM > Manage AutoSSL > Excluded Domains.
Prevention
| Risk | What to do about it |
|---|---|
| Wildcard cert expires silently | Let's Encrypt wildcards still expire every 90 days. Set a cron job to re-run acme.sh and re-upload via cPanel's UAPI before it lapses. |
| New subdomain isn't covered | Wildcards only cover one level (*.yourdomain.com matches client1.yourdomain.com but not api.client1.yourdomain.com). Plan for that if you nest subdomains. |
| DNS API token overexposed | Scope the API token to DNS-edit only for that one zone, not full account access, in case the machine running acme.sh is ever compromised. |
| AutoSSL keeps re-issuing single certs | Double-check the exclusion is actually saved — it's a common miss after a cPanel account migration, since exclusion lists don't always carry over. |
For automated renewal, you can script the full loop: cron runs acme.sh's built-in renew check daily, and on success it calls cPanel's UAPI (uapi SSL install_ssl domain=yourdomain.com cert=... key=... cabundle=...) to push the renewed cert straight into cPanel without you touching the SSL/TLS Manager again.
Frequently Asked Questions
Does cPanel's free AutoSSL support wildcard certificates?
Not on standard shared hosting. AutoSSL uses HTTP-01 validation, which can't prove control over a wildcard hostname. You need DNS-01 validation instead, which requires either WHM-level DNS provider integration or a manually issued certificate you upload yourself.
Can I get a free wildcard SSL certificate without WHM or root access?
Yes. Use acme.sh (or Certbot with a DNS plugin) from any machine where you can supply your DNS provider's API credentials, then upload the resulting certificate through cPanel's SSL/TLS Manager. You don't need shell access on the hosting account itself.
Will installing a wildcard certificate break AutoSSL for my other domains?
No, but you do need to exclude that specific domain from AutoSSL's automatic runs, or it will eventually overwrite your wildcard with its own single-domain certificate.
How often do I need to renew a wildcard Let's Encrypt certificate?
Every 90 days, same as any other Let's Encrypt certificate. Wildcards get no special treatment on validity length, so automate the renewal or set yourself a calendar reminder.
What happens if I add a subdomain after the wildcard is installed?
It's covered automatically as long as it's a single level deep (anything.yourdomain.com). Multi-level subdomains like test.client1.yourdomain.com need either a separate wildcard for that level or their own certificate.
