What this guide helps you do
Use cPanel SSL/TLS tools safely and understand the DNS, certificate and redirect issues behind most HTTPS failures. AutoSSL can automate certificate issuance, but it still depends on correct DNS and a reachable domain. A certificate cannot validate a hostname that points somewhere else, is blocked by an incorrect proxy configuration, or has not propagated. Treat SSL troubleshooting as a chain: DNS resolution, certificate issuance, web-server configuration, then application redirects. This guide is written for production-minded administrators and site owners: make a backup before material changes, keep credentials private, and prefer the controls supplied by your own hosting provider when its environment differs from a generic example.
Before you begin
Record the domain, server or station you are changing and the current working state. If the task touches DNS, SSH, firewall rules, databases, stream credentials or application configuration, make sure you have a recovery path first. Screens and menu names can vary between cPanel, AzuraCast, VDO Panel and Linux releases, so follow the purpose of each step rather than forcing an old screenshot onto a newer version.
Step 1: In cPanel, open SSL/TLS Status and look at the exact hostname that is failing. Check whether the main domain, www hostname and any service subdomains are included.
In cPanel, open SSL/TLS Status and look at the exact hostname that is failing. Check whether the main domain, www hostname and any service subdomains are included.
Step 2: Confirm public DNS for the affected hostname resolves to the intended hosting service. If you recently changed nameservers or A/AAAA records, allow for propagation before repeatedly deleting certificates.
Confirm public DNS for the affected hostname resolves to the intended hosting service. If you recently changed nameservers or A/AAAA records, allow for propagation before repeatedly deleting certificates.
Step 3: Run AutoSSL if the provider exposes that action, then wait for the result. Read the validation message rather than assuming every red icon means the same thing.
Run AutoSSL if the provider exposes that action, then wait for the result. Read the validation message rather than assuming every red icon means the same thing.
Step 4: After a certificate is issued, load both the HTTPS URL and the canonical hostname in a private browser window. Check for mixed-content errors caused by hard-coded http:// assets in the site.
After a certificate is issued, load both the HTTPS URL and the canonical hostname in a private browser window. Check for mixed-content errors caused by hard-coded http:// assets in the site.
Step 5: Enable application-level HTTPS redirects only after HTTPS works. WordPress and other CMS platforms may also store their base URL, so changing server redirects without updating the application can create loops.
Enable application-level HTTPS redirects only after HTTPS works. WordPress and other CMS platforms may also store their base URL, so changing server redirects without updating the application can create loops.
Verification checklist
A healthy result means the intended hostname resolves correctly, the certificate covers it, the browser shows a trusted connection, internal assets are HTTPS, and there is only one deliberate redirect path to the preferred URL. Always test from the user side as well as the administrator side. A control panel saying “active” is useful evidence, but it is not the same as an external browser, player or SSH client proving that the full path works.
Troubleshooting method
When the result is not what you expected, avoid changing several unrelated settings at once. Identify the last known-good point, collect the exact error message and determine which layer is failing: DNS, network, authentication, service process, application configuration, web/stream delivery or browser/player. Check timestamps and logs around the failure. If you need to escalate to hosting support, include the affected hostname or station, the time of the test, what you expected, what happened instead and the checks you already completed. Do not include passwords, API keys or private stream keys in a public ticket or screenshot.
Keep the system maintainable
Document the final configuration after it works. Note the important URLs, service names, backup locations, renewal/expiry dependencies and any change that would surprise another administrator. Revisit the setup after major platform upgrades because defaults, supported runtimes and interface labels evolve. A reliable environment is not one that was configured once; it is one whose current state is understood, monitored and recoverable.
Where to go next
Use the related guides below to expand the setup rather than solving the same problem from scratch. If the platform has outgrown shared hosting or you need managed implementation, the service recommendation at the bottom of this guide links to the most relevant hosting, streaming, development or optimisation option on this site.
Interface labels and supported versions can change. Use the controls and documentation supplied with your current hosting environment, and keep a backup or recovery path before material changes.