If your main website shows a secure padlock but visiting an addon domain or subdomain still triggers a certificate warning, the SSL certificate on your account simply doesn't list that domain yet. Certificates only secure the exact names they were issued for, so adding a domain to your hosting account doesn't automatically add it to an existing certificate. Here's how to check which domains your certificate covers and get the missing one included.
How to Check Which Domains Your Certificate Covers
Before changing anything, confirm this is actually the problem. Visit the affected domain in your browser and click the padlock or warning icon to view the certificate details, then check the list of names it covers (sometimes shown as "Subject Alternative Names"). If your addon domain or subdomain isn't in that list, that confirms the issue.
In cPanel
- Log in to cPanel and open SSL/TLS Status under the Security section.
- Find the addon domain or subdomain in the list. If it shows a red or grey icon instead of a green padlock, it isn't currently covered by a valid certificate.
- Select the domain's checkbox and click Run AutoSSL to request a new certificate that includes it.
- Wait a few minutes, then refresh the page. The domain should now show a green padlock once AutoSSL has issued and installed the certificate.
AutoSSL runs automatically on a schedule, but it sometimes skips a newly added addon domain or subdomain until its next scheduled pass, or if the domain's DNS wasn't pointing to the server yet when AutoSSL last ran. Running it manually after adding a new domain avoids waiting for that.
In DirectAdmin
- Log in to DirectAdmin and open SSL Certificates under the Account Manager (or Advanced Features, depending on your DirectAdmin theme).
- Select the domain name from the domain selector at the top if you manage more than one domain.
- Choose Free & automatic certificate from Let's Encrypt.
- In the list of names to include, make sure the addon domain or subdomain's checkbox is ticked, then click Save.
In DirectAdmin, each domain and subdomain usually needs to be explicitly selected when requesting or renewing a certificate. If you added the domain after the last certificate was issued, it won't be included until you request a new one that lists it.
Make sure the addon domain or subdomain's DNS is already pointing to your hosting account before requesting the certificate. Both AutoSSL and Let's Encrypt confirm ownership by checking that the domain resolves to your server, so a certificate request will fail if the DNS hasn't propagated yet.
If the Certificate Still Doesn't Cover the Domain
- Double-check the domain is listed under Addon Domains or Subdomains in your control panel, not just set up elsewhere in DNS.
- Clear your browser cache or try an incognito window. Browsers sometimes keep showing an old certificate warning after a new one has been installed.
- Give it 15 to 30 minutes after DNS changes before requesting the certificate, especially if you just pointed the domain to your hosting account.
If none of this resolves it, open a support ticket with your domain name so the correct certificate can be reissued on your account.
For background on how AutoSSL secures your main domain, see How to Install a Free SSL Certificate with AutoSSL.