AutoSSL: install or fix your free SSL

AutoSSL installs your free Let's Encrypt certificates automatically and renews them before they expire. If a domain shows as not secure, for example because it's new or was only just pointed to us, you can run AutoSSL yourself.

Run AutoSSL

1. Log in to cPanel from your service page under Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services).
2. Type SSL in the search bar and open SSL/TLS Status.
3. Click Run AutoSSL.

It usually finishes within 5 minutes, but can take up to an hour. When it's done, each domain shows a green padlock.

If a domain still isn't secured

• Check that the domain points to us. AutoSSL can only validate domains that use our nameservers or point to your hosting. See Which nameservers do I use? If you've only just changed DNS, wait a few hours and run AutoSSL again.
• Exclude domains you don't use. If a domain or subdomain in your account isn't hosted with us, for example mail. on a domain whose email is elsewhere, tick it in SSL/TLS Status and click Exclude Domains from AutoSSL. It will then stop showing an error.

"AutoSSL reduced coverage" or "certificate expiring" emails

cPanel emails you when AutoSSL couldn't include every name on your account in the certificate. Often the names it lists are system subdomains that cPanel adds automatically, such as cpanel., webmail., webdisk., cpcalendars., cpcontacts., autodiscover. or mail..

• If your main domain and www still show a green padlock in SSL/TLS Status, your website is secure and the email can usually be ignored.
• To stop the warnings, exclude the subdomains you don't use (see above). If your email is hosted elsewhere, such as Microsoft 365 or Google, exclude mail., webmail. and autodiscover..
• If the email lists your main domain or www, act on it. Check that the domain still points to us, then run AutoSSL again.

Using Cloudflare?

If your domain's DNS is on Cloudflare with the proxy turned on (the orange cloud), Let's Encrypt has to reach your site through Cloudflare to check it. AutoSSL errors such as 403 unauthorized or NXDOMAIN looking up TXT for _acme-challenge usually mean something at Cloudflare blocked that check. Try these in order:

1. Let the validation path through. In Cloudflare, make sure no firewall (WAF) rule, Bot Fight Mode, challenge or redirect rule applies to /.well-known/acme-challenge/. A custom rule that skips security for that path is the usual fix. Then run AutoSSL again.
2. Quick test: switch the record to DNS only (grey cloud), run AutoSSL in cPanel, wait for the certificate, then turn the proxy back on. This gets you a certificate today, but the same problem can come back at the next renewal, so fix the cause too.
3. Hand the validation records to us. AutoSSL can also validate by DNS. It creates the _acme-challenge TXT records automatically in your cPanel DNS zone, but Cloudflare can't see them. Advanced users can fix this by adding NS records in Cloudflare for _acme-challenge (and _acme-challenge.www) that point to our nameservers. Not sure? Open a ticket and we'll give you the exact records.

In Cloudflare's SSL/TLS settings, use Full (strict) mode once your certificate is in place. Flexible mode can cause redirect loops with our servers.

Still stuck? Open a support ticket with the domain name and the error from SSL/TLS Status, and we'll check it for you.