Issue an SSL Certificate in cPanel After a DNS Change

You've pointed a domain at WP Aligned hosting and the site shows a certificate warning, or cPanel shows no certificate for it. You don't have to wait for the next automatic AutoSSL run. Once the domain's DNS resolves to our server, you can request a free Let's Encrypt certificate yourself from the SSL/TLS Wizard in cPanel. This guide covers the checks to make first, the exact steps, how to confirm the certificate installed, and what to do when the request fails.

When to use this

Use the Wizard when all of these are true:

• The domain's DNS now points at your WP Aligned server.
• The domain, or its www. name, shows no certificate or a certificate warning in the browser.
• You want the certificate now, not at the next AutoSSL run.

If the domain's DNS still points at the old host, the Wizard can't help. A certificate authority only issues a certificate for a name after it confirms the name resolves to the server asking for it. cPanel's own documentation says the same: a domain can't be ordered if it doesn't point to your server's IP address. Fix DNS first.

Step 1: Confirm the domain resolves to our server

DNS changes can take time to reach every resolver, and one wrong record is the most common reason a certificate request fails. Check from a terminal:

dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A
dig +short www.example.com AAAA

What you want to see:

• Every A answer is your server's IP address, shown in your hosting welcome details or in cPanel under General Information.
• No AAAA (IPv6) answer, unless that IPv6 address is also on our server. A leftover AAAA record that points at the old host is a frequent cause of failed validation, because the check can reach the old host over IPv6 instead of us.
• If the domain is behind Cloudflare with the orange cloud on, dig shows Cloudflare addresses, not ours. That's expected. See the Cloudflare notes below.

To compare against a specific resolver instead of your local cache, add @1.1.1.1:

dig +short example.com A @1.1.1.1

If the answers are still the old ones, wait for the record's TTL to run out and check again. See WordPress White Screen or Site Down? Check Domain and DNS for more on reading DNS results.

Step 2: Open the SSL/TLS Wizard

1. Log in to cPanel.
2. Go to Security > SSL/TLS Certificates. You land on the Wizard tab.
3. Under Issue a certificate, tick the domain you want to secure. Tick the plain domain (for example example.com). If the www. name resolves to our server, cPanel includes it when it passes validation.

Don't tick the *. wildcard rows unless you know you need a wildcard certificate. A normal WordPress site doesn't.

4. Click Continue.

Step 3: Request the Let's Encrypt certificate

1. On Select the product that you would like for this certificate, click Let's Encrypt Certificate (labeled "Request a basic certificate").

2. cPanel starts the request right away. There is no confirmation screen after this click. The domain row shows Adding certificate... and two notices appear: "Requesting the free Let's Encrypt certificate..." and "Let's Encrypt is adding your certificate."

3. Wait a few minutes, then go to the next step. You don't need to do anything else, and you don't need to click the button again.

cPanel's documentation notes that a domain can't be ordered while it already has a pending certificate, so clicking repeatedly doesn't speed anything up.

The certificate is installed on the site for you. You don't download or paste anything.

Step 4: Confirm the certificate installed

1. In SSL/TLS Certificates, open the Status tab.
2. Find the domain. A working certificate shows a valid status with an expiry date about 90 days out. On our servers, domains with a current Let's Encrypt certificate show AutoSSL Domain Validated and "The certificate will renew via AutoSSL."

3. Confirm from outside cPanel. This prints the certificate a visitor actually receives:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -subject -dates

The issuer should name Let's Encrypt, the subject should be your domain, and notAfter should be roughly 90 days out.

4. Open the site in a private window. You should see the padlock. If a page was cached with errors, purge LiteSpeed Cache. See How to Clear LiteSpeed Cache on WP Aligned Hosting.

Once the certificate is in place, finish the move to HTTPS in WordPress itself. See WordPress SSL Certificate: Add HTTPS on WP Aligned Hosting.

If the certificate doesn't appear

Check the Status tab. It shows the reason for each name in red. The messages look like this:

DNS DCV: No local authority: "www.example.com"; HTTP DCV: "www.example.com" does not resolve to any IP addresses on the internet.

That message means there is no DNS record for the name. Work through these in order:

1. The name has no DNS record. Add an A record for it pointing at the server, or ignore the error if the site never uses that name. A missing www. record only matters if visitors use www..
2. The name resolves somewhere else. Re-run the dig checks in Step 1. The usual causes are the old A record still in place, an old AAAA record, or you edited DNS at the registrar while the nameservers are at another provider such as Cloudflare. Edit the records where the domain's nameservers actually are.
3. Cloudflare is proxying the domain. Validation reaches Cloudflare first. Either set the record to DNS only (grey cloud) until the certificate is issued, or keep the proxy on and make sure the encryption mode is Full, not Flexible, as described in WordPress SSL Certificate: Add HTTPS on WP Aligned Hosting. Turn the proxy back on afterward if you want it.
4. Something blocks the validation path. A security plugin, a firewall rule or a custom .htaccess rule can deny /.well-known/, the folder used to prove you control the domain. Make sure nothing blocks it. Also make sure a redirect rule doesn't send /.well-known/ requests to a login page or another domain.
5. The domain isn't in the Wizard list. Only names cPanel knows about appear. Add the domain under Domains > Domains first, then reload the Wizard.

After you fix the cause, go back to Step 2 and request the certificate again.

Prevention

• Lower the DNS record's TTL a day before a planned move, so the switch reaches visitors quickly.
• Remove old AAAA records when you repoint a domain, or replace them with our IPv6 address if you have one.
• Switch DNS first, check with dig, then request the certificate. Requesting it earlier only produces an error.
• Use a preview link to test the site on our server before the DNS change, so the only thing left to do afterward is the certificate.

When to contact us

Open a ticket if:

• DNS resolves to our server (the dig checks pass) and the Wizard request still hasn't produced a certificate after an hour.
• The domain is missing from the Wizard list even though it's added in cPanel.
• The site shows an expired certificate.

Include the domain and the exact red message from the Status tab. See Need Help? for how to reach us.

FAQ

How long does a Let's Encrypt certificate take to install in cPanel?

Usually a few minutes after you click Let's Encrypt Certificate, as long as the domain already resolves to our server. cPanel's documentation doesn't give a time for this type of certificate, so check the Status tab rather than waiting a fixed period.

Do I need to run the Wizard for every renewal?

No. Let's Encrypt certificates last 90 days, and AutoSSL renews them automatically as long as the domain still points at our server. See WordPress SSL Certificate: Add HTTPS on WP Aligned Hosting.

Can I request the certificate before changing DNS?

No. The certificate authority has to confirm the domain resolves to our server. Use a preview link to test the site first, then switch DNS, then request the certificate.

Should I buy a certificate instead?

Not for a normal WordPress site. The free Let's Encrypt certificate is trusted by current browsers. Ask us first if you need an organization-validated or extended-validation certificate.