How to Include or Exclude a Domain from AutoSSL in cPanel?

In cPanel, go to Security and open SSL/TLS Status, or on newer servers open SSL/TLS Certificates and then its Status tab. Select the domain and click the include or exclude control (Include # Domain(s) in AutoSSL, or Include X Domains in AutoSSL in the newer interface). To undo an exclusion, select the domain again, include it, then click Run AutoSSL to reissue.

Before you start

• Your domain must resolve to the Hostworld cPanel server. If you use Hostworld DNS, set your registrar to ns1.serverworld.uk, ns2.serverworld.uk, ns3.serverworld.uk and ns4.serverworld.uk. If you use external DNS, ensure your A and AAAA records point to the correct server IP.
• Remove or fix any AAAA record that points to an IPv6 address not on our server. Many certificate authorities will not fall back to IPv4.
• Do not block the DCV paths. Your redirects must allow /.well-known/pki-validation/ and /.well-known/acme-challenge/ to load.

Step 1: Open the SSL area in cPanel

1. Log in to cPanel for your hosting account.
2. Open Security, then:
   • SSL/TLS Status, which is a single page with no tabs, or
   • SSL/TLS Certificates, which is the newer unified interface, then its Status tab.
   Which one you see depends on cPanel version and server settings.

Step 2: Include or exclude the domain

If you see “SSL/TLS Status”

1. To exclude: tick the domain or subdomain. Click Exclude from AutoSSL beside it, or use Exclude # Domain(s) from AutoSSL.
2. To include again: use the Included or Excluded filters at the top, tick the domain, then click Include # Domain(s) in AutoSSL.
3. To issue now: click Run AutoSSL. Otherwise AutoSSL will run automatically later.

If you see “SSL/TLS Certificates” (unified interface)

1. Click the Status tab.
2. If you see Include X Domains in AutoSSL and Exclude X Domains from AutoSSL, select the domains and click the action you want. Then click Run AutoSSL to issue immediately.
3. If you do not see those controls, they are hidden by default in this interface. Open a support ticket and we will enable them or make the change for you.

Do not uninstall an existing certificate while you are changing AutoSSL settings. If issuance fails, your site will present no valid HTTPS certificate. There is also a WHM-level AutoSSL option that allows AutoSSL to replace certificates it did not issue, which can quietly swap a paid OV or EV certificate for a domain-validated one. That setting is ours to manage on a shared server, so if you have a paid certificate installed, tell us before you change anything.

If it does not work

• You cannot see Include or Exclude: on the unified SSL/TLS Certificates page these buttons are disabled by default. They can also be missing if your account is not enabled for AutoSSL, or a non-AutoSSL certificate is already installed for that name. Do not remove the existing certificate. Open a support ticket and we will check and adjust the server settings safely.
• Certificate will not issue after including: fix DNS so the domain resolves to our server, as set out in Before you start, and remove any wrong AAAA record. Then run AutoSSL again.
• A CAA record is blocking issuance: if the domain has a CAA record, it has to authorise the certificate authority AutoSSL uses. One that does not list it will stop the certificate being issued, even when DNS and the DCV paths are correct. If you are not sure what the record should say, open a support ticket and we will tell you the value to allow.
• A wildcard name is not covered: AutoSSL can only secure a wildcard when it can validate over DNS, which means the domain's DNS has to be hosted on the server. If your DNS is at your registrar or elsewhere, move it to Hostworld or secure the individual subdomains instead.
• Redirects break validation: if you force HTTPS or redirect to another host, add exceptions for /.well-known/pki-validation/ and /.well-known/acme-challenge/. Then run AutoSSL again.

What next

If you want a deeper walkthrough of SSL options and renewal behaviour, or you would like us to look at a DCV failure, open a support ticket and tell us the domain you changed. If you manage SSL on your own server, see our VPS guides and our UK VPS range.