Our web hosting, WordPress and cPanel hosting plans include a free, automatically renewing Let’s Encrypt SSL/TLS certificate for every domain and subdomain associated with the hosting account. This article explains how this works in practice on aWh hosting accounts. To find out what Let’s Encrypt is and how it issues certificates, please read the article ‘What is a Let’s Encrypt SSL?’.

How do you obtain a certificate?

• You do not need to do anything on cPanel hosting: cPanel’s AutoSSL feature automatically requests a certificate for every domain and subdomain associated with the hosting account. When a new domain or subdomain is added, it attempts to issue the certificate almost immediately; otherwise, it checks every 12 hours to see which domains require a certificate.
• On the web hosting platform, the certificate must be enabled for each domain via the control panel; this takes just a few clicks. The steps are outlined in the article ‘Enabling the free Let’s Encrypt certificate on web hosting’. Once enabled, the certificate is usually ready within 10–30 minutes; the system checks the certificates once a day, at night, and renews them if necessary.

What is required for the certificate?

Before issuing the certificate, Let’s Encrypt checks that the domain points to our server. To do this:

• The domain uses the name servers we have provided for the service, or
• If you are unable to change the name servers (for example, if you are using Cloudflare), the domain’s A record (and the www record) should point to the hosting IP address;
• The domain must not have any IPv6 (AAAA) records pointing elsewhere;
• If the domain has a CAA record, Let’s Encrypt must also be included in it.

Following a name server change or migration, the certificate can only be issued once the DNS change has taken effect.

How long is it valid for, and when does it renew?

Let’s Encrypt certificates are currently valid for 90 days. Let’s Encrypt will reduce this to 64 days from 10 February 2027 and to 45 days from 16 February 2028, but as renewal is automatic on our hosting services, you do not need to take any action.

On cPanel hosting, AutoSSL begins the renewal of the certificate 29 days before it expires, so even after a few unsuccessful attempts, there is plenty of time to rectify the issue. Let’s Encrypt has not been sending expiry warning emails since 2025, so if you are unsure, check the certificate’s expiry date by clicking on the padlock icon in your browser.

Why doesn’t my domain have a certificate?

The most common causes:

• the domain is not yet pointing to our server (the nameserver or A record still belongs to the previous provider);
• The www record is missing or points elsewhere, so the www version is omitted;
• password protection, an .htaccess redirect or a security plugin is blocking the /.well-known/acme-challenge/ path;
• Configuring Cloudflare or another CDN (firewall rules, ‘Under Attack’ mode) prevents verification;
• The CAA record blocks Let’s Encrypt;
• After several unsuccessful attempts, Let’s Encrypt temporarily restricts certificate issuance;
• The domain is excluded from automatic certificate requests.

The article ‘Why hasn’t my domain received an SSL certificate? (AutoSSL errors)’ provides detailed information on identifying and resolving errors. If, despite this, the certificate is still not issued, please contact us via the client portal and send us the error message.

When is an alternative solution required?

• If you have your own VPS or server, you will need to apply for the certificate yourself, for example using Certbot.
• If the certificate needs to include the company’s verified name, or if you require a warranty, you will need a paid certificate.