AutoSSL: Enable separately for mail or website.

To be honest, SSL isn't as much of a strain on systems as it once was. It would be even more amazing when HTTP/2 is supported by cPanel!

I'm confused. Just because you have generated a certificate does not mean you need to enforce https:// on the site/app/domain end. But if you do in the future, consider more than load: People think the green lock is the norm, Chrome shows a nasty "not secure" warning in red if no SSL, Google ranks secure sites higher, and data profiling, MiTM, or other forms of activity monitoring/hijacking are actually things regardless of whether or not private data is flowing. Also, the overhead and handshakes from certs is not that huge now. HTTP2 is tiny load compared to ye olde days of the past. You can further offset it by using a caching CDN like Cloudflare. It won't do an origin pull every time, and in those cases will handle the front end SSL mitigations instead of your server.

When I was reading your reasoning for not wanting to use SSL, I was thinking exactly what dhaupin said. Even if your site doesn't have data that you think should be encrypted, with SSL, you can setup HSTS to prevent man-in-the-middle attacks so when someone is going to your website, they're certain they're actually at your website, and not someone elses.

I think the whole idea behind Let's Encrypt was to make the entire web use SSL so we could do away with things like man-in-the-middle attacks.

I have a feeling that eventually (probably more sooner than later), because we can obtain free SSL certificates, the browsers might require users to go to the secure version of sites. I know they already have a pre-load list, which says the users can only go to a secure version of a website, never the unsecure version.

It sounds like what you're looking for is more like Prevent Specific Domains From Being Issued SSLs, rather than this one, but I can see how they go together.

Hi Benny! Please don't close this topic.

I want to echo Neil Spierling's request regarding mail.domain certs - as we too handle mail externally. We are currently working through development of scripts to prune the mail.domain.tld apache aliases which are automatically created by cPanel - partially because of the headaches they cause for AutoSSL. This is admittedly 'hacky' and we would love to see a proper, supported solution.

The 'Prevent Specific Domains From Being Issued SSLs' request mentioned prior is definitely a nice feature, but it's a UX proposed for unique domains and one-off url blacklisting via cPanel account UI. What we need is a facility in WHM to administratively address an issue that happens at scale.

I do think this would probably be more cleanly resolved if we just had a supported way to disable mail features globally (or by Feature Package). Given the market growth cloud productivity/communication offerings (GSuite, Microsoft 365, etc.) - it should definitely be on the radar.

Same issue as David here.

We have customers who will pay for a relatively expensive cert for their ecommerce website that end up losing SSL on their mail.domain.com sub-domains as it only covers www and the main domain. It would be useful to still keep AutoSSL for their other domains and sub domains.

Also slightly awkward explaining to them that their free LetsEncrypt SSL covers more than the one they've just paid out for, ignoring the other reputation benefits or warranty of course.

I have this same issue. I need an EV rated certificate on my public facing e-commerce site, and an autogenerated certificate on cpanel, webmail and mail.

Unless I'm getting the sequencing wrong, that doesn't work and it would appear to be far from user friendly.

ie. I have AutoSSL running on everything including domain.tld, http://www.domain.tld, mail.domain.tld, cpanel.domain.tld etc.

Then a customer buys a cert for domain.tld & http://www.domain.tld and installs it. mail.domain.tld stops having SSL.

If I remove the bought SSL and go back to AutoSSL, everything works again. Then I disable domain.tld & http://www.domain.tld and run AutoSSL. It generates a new cert without those.

Now install the bought SSL for domain.tld and www. mail.domain.tld etc stop working again.

@aegis . When you create the mail.domain.tld subdomain the system will install the existing AutoSSL cert that was previously being used for domain.tld when mail.domain.tld was associated with it on it so it will be covered. This assumes the install best available certificate functionality has not been disabled.

You can then install the purchased cert for domain.tld and http://www.domain.tld over the AutoSSL one without losing coverage.

Re: Already Exists; But there is no way to manage this at scale administratively within WHM. This is a big need for those of us who do not use cPanel's mail server, but instead route all client mail through Exchange, GSuite, etc.

Ill echo a previous comment I made on this thread (still in unposted moderation after months?) that this would probably be more cleanly resolved if we just had a supported way to disable ALL mail features globally (or per-account by Feature Package). Given the market growth cloud productivity/communication offerings (GSuite, Microsoft 365, etc.) - it should definitely be on the radar.

The workaround does work but then it has an adverse effect on the the proxy domains(cpanel.domain.tld and webmail.domain.tld) that are meant to be there to workaround accessing the cpanel and webmail dashboards from behind firewalls.

So it's clear that this is not an ideal solution!!