Why doesn't SSL cover webmail, mail, cpanel, whm subdomains?

[MrCanada]

Hello. I installed SSL on my domain (example.com) which also works if you go to www.example.com. My problem is, when I try to go to the following subdomains which I need for management and sending emails, it will throw a security warning because SSL is not working on them. Here is a picture of it in my cpanel:

- Removed -

I thought when I installed SSL it would at least cover the standard subdomains like cpanel, whm, webmail, mail.

cpanel.mydomain.com
whm.mydomain.com
webmail.mydomain.com
mail.mydomain.com

What are my options? Do I really have to buy an expensive wildcard SSL just to put SSL on these subdomains so I can do things like access cpanel, whm, webmail, mail securely?

 

[cPanelMichael]

Hello,

SSL certificates for the proxy subdomains (e.g. cpanel, whm, webmail, mail) are included for free as part of the AutoSSL feature:

Manage AutoSSL - Version 70 Documentation - cPanel Documentation

Are you using AutoSSL on this system?

Thank you.

 

[linux4me2]

I'm still using WHM 68, but I have noticed lately that when a new account is added in WHM, and AutoSSL is enabled for the user in Manage AutoSSL, the main domain is provided with a certificate, but the subdomains webdisk, webmail, cpanel, and autodiscover are not. If I look at the AutoSSL logs, there will be an error regarding the subdomains not being resolved, and the red, unlocked padlocks appear by the domains in Manage SSL Hosts as the OP shows in his image.

The workaround I use is to edit the DNS zone for the affected user, adding A records for each unsecured subdomain (they are apparently not added to the DNS record when the user account is created) using the IP for the domain. The next time AutoSSL runs, the certificates are added, the errors in the logs go away, and all is good.

I think the issue is not with AutoSSL, but that the subdomains aren't being added to the DNS Zones when an account is created, so when AutoSSL tries to add the certificates, it is unable to resolve the subdomains.

 

[cPanelMichael]

Hello,

Check to make sure the following options are enabled under the "Domains" tab in "WHM >> Tweak Settings" on this system:

Proxy subdomains
Proxy subdomain creation

Additionally, for your existing domain names, you can run the following command to add the missing DNS entries:

/scripts/proxydomains add --ifenabled

Note that in cPanel version 70, we automatically complete a one time check on the server to check for missing proxy subdomain entries:

Fixed case CPANEL-17258: Do a one time check for missing proxy subdomains.

Thank you.

 

[linux4me2]

In my case, proxy subdomain creation was disabled in WHM -> Tweak Settings -> Domains.

 

[jamiepenner]

Discovered today that cachewall also prevents AutoSSL from updating certificates properly