# Install a free SSL certificate
Source: https://docs.webgee.com/en/security-ssl/free-ssl-certificate















WebGee issues and renews free SSL certificates through **AutoSSL** at no cost
for the lifetime of the account. Applies to shared and reseller hosting.

<Callout type="warn">
  New domains are **excluded from AutoSSL by default**. Running AutoSSL without
  including them first does nothing. This is the step most people miss, and the
  reason a site sits without a certificate indefinitely.
</Callout>

## Issue your first certificate [#issue-your-first-certificate]

1. In cPanel, open **SSL/TLS Status** in the **Security** section.

   <img alt="SSL/TLS Status showing unsecured domains, each marked as excluded from AutoSSL" src="__img0" />

   Every domain reads &#x2A;"No certificate available. AutoSSL will attempt to secure
   this website, but the domain will be excluded."* That last clause is the
   problem.

2. Tick the checkbox in the **table header** to select every domain at once.

   <img alt="All domains selected, with the button now reading Include 10 Domains during AutoSSL" src="__img1" />

   The button changes to show how many are selected.

3. Select **Include Domains during AutoSSL**.

   <img alt="Confirmation that the AutoSSL exclusion was removed from all domains" src="__img2" />

   You should see confirmation naming each domain whose exclusion was removed.

4. Select **Run AutoSSL**.

   <img alt="AutoSSL in progress" src="__img3" />

5. Wait for the check to complete, then reload the page.

   <img alt="All domains showing AutoSSL Domain Validated with a green padlock and expiry date" src="__img4" />

Each domain should now show a green padlock, **AutoSSL Domain Validated**, and a
renewal note. The banner about unsecured domains disappears.

Issuance normally takes a couple of minutes.

## Include everything, not just your main domain [#include-everything-not-just-your-main-domain]

Select all the domains rather than only the one your website uses. The list
includes the service subdomains cPanel creates:

`mail.` · `cpanel.` · `webmail.` · `webdisk.` · `cpcontacts.` · `cpcalendars.` ·
`autodiscover.` · `autoconfig.`

These matter more than they look. `mail.` is what mail clients connect to, and
`autodiscover.` and `autoconfig.` are what let Outlook and Apple Mail configure
themselves. Without certificates, those connections produce security warnings
even though the website itself is fine.

## After it is issued [#after-it-is-issued]

Installing a certificate does not send visitors to the secure version of your
site — that is a separate setting. See
[Force HTTPS on your site](/en/security-ssl/force-https).

## Check it worked [#check-it-worked]

Visit `https://example.com` and confirm there is no browser warning. Or from a
terminal:

```bash
curl -sI https://example.com | head -n 1
```

**SSL/TLS Status** also shows each domain's certificate and expiry date.

The cPanel dashboard sidebar is the quickest confirmation. Before issuance it
reads **Inactive*&#x2A;, with &#x2A;"Your domain is at risk!"*; afterwards it reads
**Active** with a link to view the certificate.

<img alt="The cPanel sidebar showing SSL Certificate: Active" src="__img5" />

## About the certificates [#about-the-certificates]

* Issued by **Sectigo**, with 256-bit encryption.
* Valid for **90 days** and renewed automatically before expiry, so in practice
  they do not lapse.
* Free for the lifetime of the account.

Once a domain is included, renewals need no further action — the inclusion is a
one-off.

## If AutoSSL cannot issue [#if-autossl-cannot-issue]

### The domain does not resolve to your account [#the-domain-does-not-resolve-to-your-account]

AutoSSL proves you control the domain by fetching a file from it over HTTP. If
the domain points elsewhere, or DNS has not propagated, validation fails. Check
with
[what nameservers your domain uses](/en/domains-dns/how-do-i-check-what-nameservers-my-domain-is-using).

This is the second most common cause after exclusion, and the two look identical
in the interface — both leave the domain without a certificate.

### The domain is subject to export restrictions [#the-domain-is-subject-to-export-restrictions]

Sectigo cannot issue to domains in certain jurisdictions under US export law:
Afghanistan, Cuba, Eritrea, Guinea, Iran, Liberia, North Korea, Northern Cyprus,
Sudan, Sierra Leone, South Sudan, Syria and Zimbabwe.

Let's Encrypt has no such restriction. Select it as the provider in **SSL/TLS
Status**, or see
[Install a wildcard certificate via Let's Encrypt](/en/security-ssl/how-do-i-install-a-wildcard-ssl-certificate-via-letsencrypt).

### You need a wildcard certificate [#you-need-a-wildcard-certificate]

AutoSSL issues per-hostname certificates, not wildcards. For `*.example.com`
see
[Install a wildcard certificate via Let's Encrypt](/en/security-ssl/how-do-i-install-a-wildcard-ssl-certificate-via-letsencrypt).

### Service subdomains on alias domains [#service-subdomains-on-alias-domains]

AutoSSL does not cover service subdomains such as `mail.` or `cpanel.` on alias
domains. See
[Why AutoSSL doesn't cover service subdomains](/en/security-ssl/why-autossl-doesnt-cover-service-subdomains-for-alias-domains-in-cpanel).

## Related [#related]

* [Force HTTPS on your site](/en/security-ssl/force-https)
* [Mixed content errors](/en/security-ssl/what-are-mixed-content-errors-and-how-do-i-resolve-them)
* [Install a wildcard certificate via Let's Encrypt](/en/security-ssl/how-do-i-install-a-wildcard-ssl-certificate-via-letsencrypt)