The short answer: go to cPanel → SSL/TLS → Let's Encrypt™, select your domain, and click Install. On most shared hosting plans it's already available at no extra cost and renews automatically every 90 days.
If you want to understand what happens behind that button — and what to do when something goes wrong — this guide walks you through every step.
What Is Let's Encrypt and Why Use It?
Let's Encrypt is a free, automated, and open certificate authority launched in 2016 by the Internet Security Research Group (ISRG). It issues 90-day SSL/TLS certificates that browsers trust exactly the same as paid ones.
Key advantages:
- Zero cost — no paid tier, no premium version.
- Automatic renewal — cPanel renews it before expiry, no action needed.
- Subdomain coverage — secure
www,mail,webmail, and more in one click. - Domain Validation (DV) — sufficient for 95% of websites.
The only real limitation is that it does not offer Extended Validation (EV) or Organization Validation (OV), which some regulated industries require. For an informational site, a standard e-commerce store, or a blog, Let's Encrypt is more than enough.
Requirements Before You Begin
Before clicking anything, verify these points:
- Your domain correctly points to the server (DNS propagated). You can check this with elenlace.com's DNS diagnostic tools.
- Your hosting provider runs cPanel 78 or higher (native Let's Encrypt integration arrived in that version).
- Port 80 (HTTP) is not blocked — Let's Encrypt needs it for the HTTP-01 challenge that verifies you control the domain.
- You don't have an active paid SSL certificate that might conflict.
If your hosting uses WHM/cPanel with AutoSSL enabled globally, the certificate may already be installed. Go to cPanel → SSL/TLS → Manage SSL Sites to check.
Step by Step: Installing Let's Encrypt in cPanel
Option A — AutoSSL (most common)
Most providers enable AutoSSL with Let's Encrypt as the provider. In that case:
- Log into your cPanel and find the Security section.
- Click SSL/TLS, then Manage SSL Sites.
- Check whether your domain already shows a green padlock. If so, HTTPS is already active.
- If not, look for the Run AutoSSL button (it may be on the same page or in your hosting admin panel).
- Wait 2–5 minutes and refresh. The certificate will appear automatically.
Option B — Let's Encrypt Plugin (cPanel 11.68+)
Some providers install the official Let's Encrypt plugin for cPanel:
- Go to cPanel → Security → Let's Encrypt™.
- You'll see a list of domains available in your account.
- Check the main domain and any subdomains you want to protect (
www,mail, etc.). - Click Issue Certificate or Install.
- The process takes 30 seconds to 2 minutes. When done, you'll see Installed next to each domain.
Option C — Manual Install with Certbot (if you have SSH access)
If your provider doesn't have AutoSSL and you have SSH access to the server:
sudo certbot --apache -d yourdomain.com -d www.yourdomain.comCertbot detects your Apache or Nginx configuration, obtains the certificate, installs it, and automatically configures the HTTP-to-HTTPS redirect. This option requires root permissions and is more common on VPS or dedicated servers.
Forcing HTTPS After Installing the Certificate
Having the certificate installed isn't enough — you need to redirect all HTTP traffic to HTTPS. Two ways to do it:
From cPanel (no code required)
- Go to cPanel → Domains → Domains (or search for "Force HTTPS").
- Toggle Force HTTPS Redirect on next to your domain.
Via .htaccess (for WordPress and PHP sites)
Add these lines at the top of your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]After enabling HTTPS, update the URL in your CMS. In WordPress: Settings → General → change both URL fields to https://.
Troubleshooting Common Errors
| Error | Likely Cause | Solution |
|---|---|---|
| Rate limit exceeded | More than 5 failed issuances in 1 hour for the same domain | Wait 1 hour and retry. Don't run repeated tests on production. |
| DNS validation failed | Domain DNS doesn't point to the correct server | Check A/AAAA records in your DNS zone and wait for propagation. |
| Port 80 blocked | Firewall or CDN blocking HTTP | Temporarily open port 80 or use the DNS-01 challenge instead. |
| Certificate not recognized by browser | Browser cache | Clear cache or test in incognito mode. |
| Mixed content warning | Internal resources loading over HTTP | In WordPress, use the "Better Search Replace" plugin to swap http:// for https://. |
Automatic Renewal: Is There Anything to Do?
On cPanel with AutoSSL enabled, you don't need to do anything. The server checks expiring certificates daily and renews them automatically. Let's Encrypt issues 90-day certificates; cPanel renews them when 30 or fewer days remain.
If you used Certbot on a VPS, renewal is scheduled via cron or systemd timer during installation. Verify it with:
certbot renew --dry-runIf the command finishes without errors, automatic renewal is working correctly.
For more SSL and web security best practices for your hosting plan, explore our complete SSL security guide on the blog.
Key Takeaways
- Let's Encrypt is free, automatic, and trusted by every modern browser.
- On most cPanel hosts, just enabling AutoSSL or clicking "Install" in the Let's Encrypt section is all it takes.
- After installing the certificate, force the HTTP → HTTPS redirect via cPanel or
.htaccess. - Renewal is automatic every 90 days — no manual action needed on shared hosting.
- The most common errors are unpropagated DNS or rate limits from excessive retry attempts.
Is your hosting provider not offering Let's Encrypt, or are you unsure which plan includes free SSL? Get in touch with the elenlace.com team and we'll help you find the right hosting with SSL included from day one.
FAQ
Is Let's Encrypt as secure as a paid SSL certificate?
Yes, in terms of encryption. The encryption level is identical (TLS 1.2/1.3, 256-bit). The difference is in validation level: Let's Encrypt only verifies that you control the domain (DV), while OV or EV certificates also verify your organization's identity. For the vast majority of websites, DV is perfectly sufficient.
How long does a Let's Encrypt certificate last?
90 days, but renewal is automatic. On cPanel with AutoSSL active, the server renews it when 30 days or fewer remain, so in practice it never expires as long as the server is running normally.
Can I use Let's Encrypt on a test domain or subdomain?
Yes, as long as the subdomain has a DNS record pointing to the server. For example, test.yourdomain.com can have its own Let's Encrypt certificate at no additional cost.
What if my cPanel doesn't have a Let's Encrypt option?
Contact your provider's support team to have AutoSSL or the Let's Encrypt plugin enabled. Alternatively, some providers offer free certificates through Sectigo or ZeroSSL. If none of these options are available, consider switching to a provider that includes free SSL out of the box.
Useful resources
Other providers and guides worth comparing:
