How to manage conflicts between AutoSSL and Cloudflare certificates in cPanel

Anyone using cPanel alongside Cloudflare has likely experienced an annoying automated behavior: you manually install a Cloudflare Origin CA certificate on web subdomains, but during the next scheduled AutoSSL cron run, cPanel flags the certificate as mismatched and overwrites it with a fresh Let's Encrypt or Sectigo certificate.

This automated replacement can break the trust chain, cause TLS handshake failures, or trigger security alerts for visitors. At the same time, disabling AutoSSL for the entire account is not an option, because email services like mail and webmail rely on it to keep their certificates continuously renewed.

I recently resolved this conflict on an account managing multiple subdomains. Here is how I segregated services and used cPanel's command-line UAPI to configure permanent exclusion rules.

1. The overwrite conflict between AutoSSL and Cloudflare origin CA#

By default, cPanel ensures that all active domains and subdomains have valid certificates issued by the server's configured provider (such as Let's Encrypt or cPanel/Sectigo).

When you use Cloudflare proxying (orange cloud enabled) and install an Origin CA certificate inside cPanel:

1. The Cloudflare Origin certificate is designed to secure traffic strictly between Cloudflare edge nodes and your origin server.
2. AutoSSL runs automated verification challenges via HTTP DCV (Domain Control Validation) or DNS.
3. If the AutoSSL validator treats the Origin CA certificate as untrusted by the local server authority, it schedules an automatic replacement.
4. During the next automated maintenance run, AutoSSL overwrites the Cloudflare certificate, creating inconsistencies in the end-to-end TLS chain.

The practical solution is to segregate domains by function:

• Web subdomains proxied by Cloudflare: must be excluded from AutoSSL checks to keep the Origin CA certificate untouched.
• Mail subdomains (mail and webmail): must remain under AutoSSL, since Cloudflare's standard proxy does not route mail ports (IMAP, POP3, and SMTP).

2. Inspecting exclusion state using cPanel UAPI#

The most reliable way to inspect and manage AutoSSL exclusions is using the uapi command-line tool. It modifies cPanel's state directly, avoiding syntax errors common in manual YAML edits.

To check which domains on the account are currently excluded from AutoSSL, run:

uapi --user=usuario SSL get_autossl_excluded_domains

If the returned list is empty or contains subdomains that should receive automated renewals (like mail or webmail), you need to update the configuration.

3. Step-by-step CLI exclusion workflow#

Step 1: Remove unintended exclusions on mail services#

If mail subdomains were previously added to the exclusion list, remove them so AutoSSL can resume automated renewal:

uapi --user=usuario SSL delete_autossl_excluded_domains domains=mail.domain.com,webmail.domain.com

Step 2: Apply the definitive web subdomain exclusion list#

Use the set_autossl_excluded_domains function. This command replaces any existing exclusion list with the specified domains; AutoSSL then never attempts to replace their certificates:

uapi --user=usuario SSL set_autossl_excluded_domains domains=app.domain.com,loja.domain.com,portal.domain.com,institucional.domain.com,pix.domain.com,hub.domain.com,totem.domain.com

4. Validating consistency and checking output#

After applying the configuration, confirm that cPanel registered the list by querying the state again:

uapi --user=usuario SSL get_autossl_excluded_domains

The structured output confirms the active exclusions:

---
apiversion: 3
func: get_autossl_excluded_domains
module: SSL
result:
  data:
    - excluded_domain: app.domain.com
    - excluded_domain: hub.domain.com
    - excluded_domain: institucional.domain.com
    - excluded_domain: loja.domain.com
    - excluded_domain: pix.domain.com
    - excluded_domain: portal.domain.com
    - excluded_domain: totem.domain.com
  status: 1

A status of 1 with only web subdomains listed confirms that your manual Cloudflare certificates will no longer be overwritten.

5. Best practices and AutoSSL log verification#

Once exclusions are set via UAPI, the account operates under a reliable hybrid model: Cloudflare protects application endpoints, while AutoSSL continues managing mail connectivity.

Key operational reminders:

1. Monitor AutoSSL logs: If you suspect an excluded domain is still being queried by automated checks, inspect the latest log file inside /var/cpanel/logs/autossl/. The log explicitly tags skipped domains with a manual user exclusion flag.
2. Handling new subdomains: Whenever you provision a new subdomain with a Cloudflare Origin CA certificate, remember to update the exclusion list via set_autossl_excluded_domains to prevent unexpected certificate replacements.
3. Prefer CLI over web interface: While cPanel provides exclusion toggles inside the user dashboard, managing exclusions via UAPI provides atomic, batch updates without relying on cached browser states.

See also

Servers Renewing expired hostname SSL certificates in cPanel and WHM (GUI & terminal)

Servers Complete Guide to DNS Zones in cPanel and WHM: Fixing 'DNS Entry Already Exists', killdns CLI, and Advanced Templates

Servers Web server ciphers: from ransomware confusion to real ssl/tls hardening

This post is licensed under CC BY-NC.