# Why AutoSSL skips some service subdomains
Source: https://docs.webgee.com/en/security-ssl/why-autossl-doesnt-cover-service-subdomains-for-alias-domains-in-cpanel



AutoSSL covers `mail.`, `cpanel.` and `webmail.` on your primary domain but not
on alias domains. Applies to shared, reseller and Premium hosting.

This is a cPanel design decision, not a fault on your account.

## What is covered [#what-is-covered]

| Domain type               | Site + `www` | Service subdomains (`mail.`, `cpanel.`, `webmail.`) |
| ------------------------- | ------------ | --------------------------------------------------- |
| Primary domain            | Yes          | Yes                                                 |
| Addon domain              | Yes          | Yes                                                 |
| Subdomain                 | Yes          | Not applicable                                      |
| **Alias (parked) domain** | Yes          | **No**                                              |

An **alias** domain is one that serves the same content as another rather than
having its own document root. cPanel does not create service subdomains for
aliases, so AutoSSL has nothing to request a certificate for.

## Why it matters [#why-it-matters]

The symptom is a certificate warning when connecting a mail client using
`mail.aliasdomain.com`, even though the website itself is secure.

## What to do instead [#what-to-do-instead]

**Use the primary domain's hostname in mail clients.** `mail.example.com` has a
valid certificate; use it for every mailbox, including those on alias domains.
The mailbox address does not have to match the server hostname — see
[Email server settings](/en/email/manual-configuration).

`webmail.webgee.com` also works for any mailbox and is always valid.

**Or convert the alias to an addon domain.** Addon domains get their own document
root and their own service subdomains, so AutoSSL covers them. This is the right
move if the domain should really be a separate site rather than an alias.

**Or issue a certificate manually** with Let's Encrypt, which can cover names
AutoSSL will not — see
[Install a wildcard certificate with Let's Encrypt](/en/security-ssl/how-do-i-install-a-wildcard-ssl-certificate-via-letsencrypt).

## Check what is actually covered [#check-what-is-actually-covered]

**cPanel → SSL/TLS Status** lists every domain and subdomain with its certificate
state. Anything showing as uncovered is either excluded by the above, or not
resolving to this server.

## Related [#related]

* [Install a free SSL certificate](/en/security-ssl/free-ssl-certificate)
* [Email server settings](/en/email/manual-configuration)