Certificate coverage.
THE SYMPTOM
A browser warning on a subdomain or addon domain while the main site is fine.
THE CAUSE
That name is not covered by a certificate.
HOW TO FIX IT
cPanel, SSL/TLS Status. Tick the affected names and run AutoSSL.
WHY IT FAILS
The domain does not resolve here yet The domain resolves to a previous host A CDN intercepting the validation request A CAA record forbidding the certificate authority
THE MOST COMMON
The domain not yet pointing here. Certificates cannot be issued for a domain we do not serve.
AFTER ADDING ANY DOMAIN
Wait for it to resolve, then run AutoSSL.
That step is frequently forgotten.
FOR MANY SUBDOMAINS
AutoSSL covers them individually. A wildcard certificate covers all at one level.
For a modest number, AutoSSL is fine.
WHAT TO MONITOR
Certificate expiry across all your names, not just the main one.
