SSL across many sites: what renews itself and what does not

Certificates are the thing on a network that fails silently and then fails loudly. AutoSSL handles the normal case on every domain. The manual controls exist for the cases it cannot cover, and knowing which is which saves you from both surprise expiries and unnecessary work.

Let the automatic path do the work

A domain-validated certificate is issued and renewed automatically on every domain, on every plan, at no cost. On a network of thirty sites that is thirty certificates you never think about, which is the correct number to think about.

The management view exists so you can confirm it is happening rather than assume it. Two things worth checking there periodically:

• Every host has a certificate. A domain added recently, or one pointed here after the account was created, is the usual gap.
• No expiry date is an outlier. If twenty-nine renew on a rolling schedule and one has a date months behind the others, renewal is broken for that account specifically.

Why automatic renewal fails, when it fails

Almost always validation, and almost always for a mundane reason:

1. The domain no longer points here. Validation cannot succeed for a name that resolves elsewhere.
2. A redirect intercepts the validation request. A blanket rule sending everything to HTTPS or to another host can swallow the check.
3. The account is suspended. Nothing is serving, so nothing validates.
4. A subdomain was added and never checked. The parent renews happily while the new host has nothing.

The first two are the common pair, and both are visible from the DNS and rewrite checks described in cPanel in Practice.

When you actually need the manual controls

Creating a signing request and installing a certificate by hand is for cases the automatic path does not cover:

• A paid certificate where your company name appears in the certificate, or a commercial warranty is required.
• A wildcard covering a domain and every subdomain one level below it under a single certificate.
• A certificate issued elsewhere that you are bringing with you.

Those start at a yearly price and are ordered separately; the detail is on the SSL certificates page. For most content networks the free tier is genuinely sufficient, and buying certificates for sites that do not need them is a common way to spend money on nothing.

The network-specific mistake

Do not put several of your domains on one certificate because it is tidier. A certificate listing twenty of your domains is a public document that ties them together, and certificate transparency logs make it findable by anyone who looks.

At the certificate layer that gives away precisely what the addresses and private nameservers are arranged to keep apart, and it happens by accident rather than by decision. The same reasoning applies to shared nameservers, covered in Nameservers and DNS.

A short routine

Once a quarter, alongside the address audit: scan the certificate list for hosts without one and for expiry dates that do not fit the pattern. Two minutes, and it catches the failure mode where a site quietly starts showing a browser warning that you only hear about from a customer.

The wider routine for keeping many sites healthy is in Running Your Estate.