Renewing expired hostname SSL certificates in cPanel and WHM (GUI & terminal)

Anyone who manages cPanel/WHM servers knows that unexpected issues happen. Recently, while trying to open the administration interface, I was greeted by a browser warning: SSL certificate expired on the hostname.

The server hostname (such as server.domain.com) is the primary address securing HTTPS traffic for cPanel (2083), WHM (2087), and internal mail services. When this SSL certificate expires, secure access is interrupted and warnings like NET::ERR_CERT_DATE_INVALID block normal logins.

Here is the step-by-step process I followed to diagnose and resolve the issue, covering both the WHM web interface and the direct terminal (SSH) workflow.

1. The issue and operational impact#

The hostname SSL certificate encrypts administrative connections on cPanel's native ports.

When it expires:

• Browsers block direct navigation, requiring users to accept a security exception or fall back to unencrypted HTTP.
• Administrative logins and credential transmissions lose a verified chain of trust.

2. Method 1: WHM web interface#

To renew the certificate through the browser:

1. Temporary Login: Access WHM by accepting the browser warning or connecting over standard HTTP (http://server.domain.com:2087).
2. AutoSSL Management: Navigate to SSL/TLS > Manage AutoSSL.
3. Trigger Renewal:

• On the Run AutoSSL tab, click Run AutoSSL For All Users to queue the system user for validation with your configured provider (Let's Encrypt or cPanel Sectigo).
• Review the Logs tab to see why the automated cron renewal failed before expiration.

1. Manual Installation (Alternative): If AutoSSL is disabled, go to SSL/TLS > Install an SSL Certificate on a Domain and paste the new Certificate (CRT), Private Key, and CA Bundle for your ServerName.

3. Method 2: direct terminal renewal (SSH as root)#

Using the terminal is the fastest method to force an immediate check and inspect output in real time.

Step 1: Run the cPanel SSL verification utility#

cPanel provides a dedicated binary to validate and renew all system and hostname certificates:

/usr/local/cpanel/bin/checkallsslcerts

This triggers the AutoSSL backend engine, validates the hostname, and requests the new certificate from the active certificate authority.

Step 2: Monitor certificate generation logs#

To inspect the renewal process in real time:

tail -f /var/log/messages

(Filter or watch for entries tagged with AutoSSL or cpanel).

Step 3: Restart services to clear SSL cache#

Web daemons and control panel services may retain expired certificates in memory. To reload the new certificate immediately:

# Restart the web server (Apache / LiteSpeed)
/scripts/restartsrv_httpd

# Restart the cPanel/WHM daemon (cpsrvd)
/scripts/restartsrv_cpsrvd

4. What to check if AutoSSL continues to fail#

If the hostname certificate fails to renew:

1. Fix SSL Paths and Permissions:

cPanel includes a repair script that resolves corrupted paths or permission mismatches across the system's SSL directory structure:

/scripts/fix_ssl_paths

1. Hostname DNS Resolution:

AutoSSL requires valid HTTP-01 or DNS-01 validation. Ensure your hostname (server.domain.com) has an active A record pointing to the server's primary IP address.

Practical emergency routine#

Running /usr/local/cpanel/bin/checkallsslcerts followed by restarting cpsrvd renews the hostname SSL certificate and restores HTTPS connectivity on port 2087. Keeping these commands handy resolves certificate expirations in under two minutes without server downtime.

See also

Servers Troubleshooting cPanel: fixing the white screen when accessing accounts via WHM (xfercpanel)

Servers How to manage conflicts between AutoSSL and Cloudflare certificates in cPanel

Servers Complete Guide to DNS Zones in cPanel and WHM: Fixing 'DNS Entry Already Exists', killdns CLI, and Advanced Templates

This post is licensed under CC BY-NC.