WHM / cPanel hostname SSL expired

Whm ssl certificate expired on server.host.example:2087 or the shared hostname cert stalls reseller work—even when customer cPanel sites still load (or vice versa).

WHM fronts cPanel on AlmaLinux/CentOS with multiple TLS contexts: hostname services, Apache vhosts, Exim/Dovecot, and API ports. AutoSSL renews many customer domains but the server hostname certificate is a separate inventory item.

Verify which port and hostname browsers complain about before running /scripts/autorepair.

First response

Record exact URL: WHM 2087, cPanel 2083, webmail :2096, or a customer domain. Screenshot certificate viewer showing notAfter.

WHM → SSL/TLS → SSL Storage Manager and Manage AutoSSL status pages—note providers (Let’s Encrypt, Sectigo) and last run errors.

SSH as root: openssl s_client -connect localhost:2087 </dev/null 2>/dev/null | openssl x509 -noout -dates if HTTPS still reachable locally. Check /var/cpanel/ssl/ paths only after external confirmation.

List whether CageFS, Imunify, or custom firewalld rules were toggled during the incident window—they can block AutoSSL HTTP DCV fleet-wide. Capture how many accounts show red in SSL/TLS Status; a single hostname cert fix does not clear a thousand customer sites.

What this error means

Administrators connect to WHM over HTTPS on the machine’s hostname certificate. When that leaf expires, modern browsers block the control panel—blocking fixes for customer sites still served by Apache with their own vhost certs.

Conversely, hostname cert may be valid while AutoSSL failed fleet-wide and many account domains present expired chains. Whm ssl certificate expired tickets specify which layer failed: management UI, mail TLS, or shared default SSL on IP.

cPanel binds a default certificate per IP; stale defaults cause wrong-hostname visitors to see expired shared certs.

Common causes

Hostname cert manually installed years ago without AutoSSL replacement schedule.

AutoSSL disabled globally or Let’s Encrypt rate limits after repeated failed validation on cpanel. subdomains.

Firewall blocks outbound 80/443 needed for AutoSSL DCV from the server. Clustered DNS only partially updated for server.hostname.com.

Exim restart skipped after cert deploy—mail clients report expiry while web works. Custom /var/cpanel/templates prevent service reload scripts from running.

CloudLinux CageFS unrelated but often coincides with postponed OS updates that lag openssl compatibility—focus on dates first.

Jetbackup or off-site backup agents connect to hostname APIs over TLS—whm ssl certificate expired on the server FQDN can stall backups while customer HTTP sites appear online. API tokens stored in configuration management systems may still call :2087 nightly; expired hostname certs break automation silently.

Confirm from the outside

WHM port:

echo | openssl s_client -connect server.host.example:2087 -servername server.host.example 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

Customer site:

echo | openssl s_client -connect customerdomain.com:443 -servername customerdomain.com 2>/dev/null \
  | openssl x509 -noout -dates -subject

curl -vkI --connect-timeout 15 https://server.host.example:2087/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|subject:'

On server:

/usr/local/cpanel/bin/autossl_check --verbose
whmapi1 get_tweaksetting key=autossl

How to read the output

Expired :2087 cert blocks admin UI—prioritize hostname replacement via WHM Install SSL on Domain for server.hostname. Valid WHM but expired customer domain means per-account AutoSSL—see cPanel AutoSSL failed. Serial unchanged after “success” means services not restarted.

Browser spot-check

Firefox and Chrome treat self-signed WHM warnings differently—test the panel URL resellers actually bookmark, not only the marketing hostname on the website.

Fix checklist

Work this list in order for WHM ssl certificate expired. Root cause should distinguish hostname, default shared IP, and per-account vhost layers before closure.

1. WHM → SSL/TLS → Manage SSL Sites / Install an SSL Website → renew hostname cert (AutoSSL or purchased).
2. Manage AutoSSL → run provider check; resolve DCV failures listed per domain.
3. /scripts/restartsrv_httpd and mail services if Exim/Dovecot use hostname cert.
4. Verify default SSL on shared IPs under SSL/TLS Status for each account.
5. External openssl WHM port and sampled customer domains.
6. Update monitoring to include :2087 from outside (if policy allows) and apex customer sites.
7. Document hostname DNS (PTR, A record) used for validation.
8. Schedule before next 90-day Let’s Encrypt cycle.

Roll out and verify

After hostname renewal, confirm reseller accounts can access WHM branding without clicking through cert warnings—some browsers cache HSTS for :2087. Spot-check Exim outbound STARTTLS with openssl s_client -starttls smtp on port 587 using the server hostname.

For fleet AutoSSL, export a CSV of domains still failing DCV and assign owners before closing the parent ticket. Whm ssl certificate expired post-mortems should note whether monitoring watched customer sites but ignored the control plane URL responders need to fix them.

Schedule autossl_check in maintenance windows with alerting muted only for known single-domain retries, not whole-server silence.

When to use automation

Resellers with hundreds of accounts need sampling plus live TLS on WHM hostname and top revenue domains. AutoSSL logs are noisy—external proof confirms presentation.

Run /check on customer-facing hosts after fleet AutoSSL. ssldays alerts at 30, 14, 7, and 1 day cover hostname and vanity domains registrar teams forget.

WHM operators need :2087 on the monitoring list—without panel access, fleet fixes stop. AutoSSL logs in /var/cpanel/logs justify which customer domains to spot-check. Pair TLS with mail submission ports if Exim presents the hostname cert to remote MTAs.

See cPanel AutoSSL failed and Plesk SSL certificate expired for peer hosting panels.

Managed hosting providers should script weekly exports of SSL/TLS Status red counts per server and trend them—spikes predict Monday customer tickets better than reactive AutoSSL. Root passwords stored in break-glass vaults become useless when :2087 certificate warnings scare junior staff away from the panel during expiry.

cPanel install scripts sometimes regenerate self-signed hostname certificates during recovery from compromise—replace them with CA-backed AutoSSL immediately or API integrations fail. Partners white-labeling nameserver brands should verify their vanity cpanel. hostnames separately from machine FQDN certificates.

Fleet whm ssl certificate expired post-mortems should count how many customer domains failed DCV versus hostname-only failures—different remediation paths. NOC teams need :2087 synthetic checks even when customer ping passes. Attach AutoSSL verbose log excerpts and openssl on server FQDN before marking major incidents resolved.

Datacenter operators should include server hostname certificate expiry in the same calendar as facility maintenance, because remote hands cannot fix customer sites when administrators cannot click past browser warnings on the control panel. Investor owned hosting rollups accumulate WHM servers with hostname certificates issued under an old brand name; renewal requires finding the mailbox that approved the original commercial order.

Customer empathy matters when thousands of sites share one expired default IP certificate; communicate fleet progress instead of closing tickets individually without explaining the shared root cause. Backup vendors and security appliances that integrate with WHM API over HTTPS need their connection paths monitored separately from shopper facing storefront domains.

Acquisition due diligence on hosting companies should sample openssl on hostname control panels and random tenant domains, because expired fleet certificates reduce perceived reliability during sales. Train NOC staff to open tickets with both WHM build version and OpenSSL library version when openssl output looks anomalous. Colocation customers with remote KVM access still depend on WHM certificates for API automation; include those integration hosts in the same renewal calendar as revenue generating tenant storefronts. Insurers asking about control plane availability during audits want proof that administrators could reach WHM without bypassing certificate warnings. Private equity rollups consolidating WHM fleets should standardize hostname certificate vendors to simplify renewal calendars across acquired brands. Municipal hosting cooperatives serving school districts should monitor student portfolio domains alongside server hostname certificates on the same WHM chassis. Payment card scanning vendors integrating with WHM billing should receive notice when hostname TLS on API endpoints is restored. Disaster recovery drills should include renewing hostname certificates on cold standby WHM nodes, not only failing over application traffic. Runbooks should name who may approve commercial hostname certificate purchases during overnight incidents. Tag every customer impact ticket with whether AutoSSL or hostname renewal resolved the presentation gap. Monthly NOC reviews should chart hostname certificate days remaining across the fleet. Escalate to vendor support when more than ten percent of monitored customer domains share one expired presentation date on a single IP. Executive summaries should separate hostname panel access risk from storefront shopper impact counts. Insurers reviewing hosting SLAs should request sampled external TLS reports quarterly. Note cold spare hostname certificates in the asset inventory.