Why AutoSSL skips some service subdomains
mail.example.com and cpanel.example.com get certificates on your main domain but not on alias domains. Why, and what to use instead.
AutoSSL covers mail., cpanel. and webmail. on your primary domain but not
on alias domains. Applies to shared, reseller and Premium hosting.
This is a cPanel design decision, not a fault on your account.
What is covered
| Domain type | Site + www | Service subdomains (mail., cpanel., webmail.) |
|---|---|---|
| Primary domain | Yes | Yes |
| Addon domain | Yes | Yes |
| Subdomain | Yes | Not applicable |
| Alias (parked) domain | Yes | No |
An alias domain is one that serves the same content as another rather than having its own document root. cPanel does not create service subdomains for aliases, so AutoSSL has nothing to request a certificate for.
Why it matters
The symptom is a certificate warning when connecting a mail client using
mail.aliasdomain.com, even though the website itself is secure.
What to do instead
Use the primary domain's hostname in mail clients. mail.example.com has a
valid certificate; use it for every mailbox, including those on alias domains.
The mailbox address does not have to match the server hostname — see
Email server settings.
webmail.webgee.com also works for any mailbox and is always valid.
Or convert the alias to an addon domain. Addon domains get their own document root and their own service subdomains, so AutoSSL covers them. This is the right move if the domain should really be a separate site rather than an alias.
Or issue a certificate manually with Let's Encrypt, which can cover names AutoSSL will not — see Install a wildcard certificate with Let's Encrypt.
Check what is actually covered
cPanel → SSL/TLS Status lists every domain and subdomain with its certificate state. Anything showing as uncovered is either excluded by the above, or not resolving to this server.